CVE-2025-3625

Published: Apr 25, 2025Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Exploitability: 2.8 / Impact: 4.2

Source: patrick@puiterwijk.org (Secondary)

Description

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

Affected (3)

Products: Moodle: Moodle

Moodle

1 product

Moodle

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	From 4.3.0 to 4.3.12
Moodle Moodle	From 4.4.0 to 4.4.8
Moodle Moodle	From 4.5.0 to 4.5.4

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://access.redhat.com/security/cve/CVE-2025-3625

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2359690

Source: patrick@puiterwijk.org

Issue Tracking

Timeline

No history available yet.