DeutschShown in its original language — a full translation is planned for a future version.
Moodle: Mehrere Schwachstellen
view advisory published 2025-12-15
Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um beliebigen Programmcode auszuführen, Benutzer auf bösartige Websites umzuleiten, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-67857US | medium5.3 | — | ||
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see inte… | ||||
| CVE-2025-67856US | critical9.8OT elevated | — | ||
A flaw was found in Moodle. An authorization logic flaw, specifically due to incomplete role checks during the badge awarding process, allowed badges to be granted without proper v… | ||||
| CVE-2025-67855US | medium6.1 | — | ||
A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This vulnerability arises from insu… | ||||
| CVE-2025-67853US | — | — | ||
A flaw was found in Moodle. A remote attacker could exploit a lack of proper rate limiting in the confirmation email service. This vulnerability allows attackers to more easily enu… | ||||
| CVE-2025-67852US | medium6.1 | — | ||
A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages after they have successfu… | ||||
| CVE-2025-67851US | high7.8 | — | ||
A flaw was found in moodle. This formula injection vulnerability occurs when data fields are exported without proper escaping. A remote attacker could exploit this by providing mal… | ||||
| CVE-2025-67850US | medium6.1 | — | ||
A flaw was found in moodle. This vulnerability, known as Cross-Site Scripting (XSS), occurs due to insufficient checks on user-provided data in the formula editor's arithmetic expr… | ||||
| CVE-2025-67849US | medium6.1 | — | ||
A flaw was found in Moodle. This cross-site scripting (XSS) vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or scri… | ||||
| CVE-2025-67848US | — | — | ||
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue ar… | ||||
| CVE-2025-67847US | — | — | ||
A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient validation of restor… | ||||
| CVE-2025-67854US | — | — | ||
02
references
External citations — patches, advisories, analysis.
- Moodle Security Advisory MSA-25-0051 vom 2025-12-15external
- Moodle Security Advisory MSA-25-0052 vom 2025-12-15external
- Moodle Security Advisory MSA-25-0053 vom 2025-12-15external
- Moodle Security Advisory MSA-25-0054 vom 2025-12-15external
- Moodle Security Advisory MSA-25-0055 vom 2025-12-15external
- Moodle Security Advisory MSA-25-0056 vom 2025-12-15external
- Moodle Security Advisory MSA-25-0057 vom 2025-12-15external
- Moodle Security Advisory MSA-25-0058 vom 2025-12-15external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan