DeutschShown in its original language — a full translation is planned for a future version.
Moodle: Mehrere Schwachstellen
view advisory published 2025-10-13
Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-62401US | medium4.3 | — | ||
An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment. | ||||
| CVE-2025-62400US | medium6.5 | — | ||
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group informa… | ||||
| CVE-2025-62399US | — | — | ||
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks. | ||||
| CVE-2025-62398US | — | — | ||
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts. | ||||
| CVE-2025-62397US | — | — | ||
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance. | ||||
| CVE-2025-62396US | — | — | ||
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured. | ||||
| CVE-2025-62395US | medium4.3 | — | ||
A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative d… | ||||
| CVE-2025-62394US | —OT elevated | — | ||
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited co… | ||||
| CVE-2025-62393US | medium4.3 | — | ||
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses… | ||||
| CVE-2025-54869US | — | — | ||
FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that… | ||||
02
references
External citations — patches, advisories, analysis.
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan