5.3

CVE-2025-62397

Moodle: router produces json instead of 404 error for invalid course id

Router produces JSON instead of 404 error when passed a non-existent course ID

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
Mögliche Gegenmaßnahme
Moodle Server: Update to a patched version.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Moodle ≫ Moodle Version >= 5.0.0 < 5.0.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Weitere Schwachstelleninformationen
SystemMoodle
≫
Produkt Moodle Server
Version >= 5.0.0, < 5.0.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.165
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
patrick@puiterwijk.org 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-209 Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

https://access.redhat.com/security/cve/CVE-2025-62397
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2404430
Third Party Advisory
Issue Tracking
https://moodle.org/mod/forum/discuss.php?d=470386
Third Party Advisory