← Back

CVE-2025-67857

nvd nist
Published: Feb 3, 2026Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.

Affected (5)

Products: Moodle: Moodle
Moodle
1 product
Moodle
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Moodle
Moodle
Before 4.1.21
Moodle
From 4.4.0 to 4.4.11
Moodle
From 4.5.0 to 4.5.8
Moodle
From 5.0.0 to 5.0.4
Moodle
Version 5.1.0

Related CWEs

CWE-201
Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (3)

Source: patrick@puiterwijk.org
Third Party Advisory
Source: patrick@puiterwijk.org
Third Party Advisory
Source: patrick@puiterwijk.org
Vendor Advisory

Timeline

No history available yet.