DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Moodle: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2025-10-13
Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.
01
beschreibt (10)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-62401US | medium4.3 | — | ||
An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment. | ||||
| CVE-2025-62400US | medium6.5 | — | ||
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group informa… | ||||
| CVE-2025-62399US | — | — | ||
Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks. | ||||
| CVE-2025-62398US | — | — | ||
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts. | ||||
| CVE-2025-62397US | — | — | ||
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance. | ||||
| CVE-2025-62396US | — | — | ||
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured. | ||||
| CVE-2025-62395US | medium4.3 | — | ||
A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative d… | ||||
| CVE-2025-62394US | —OT erhöht | — | ||
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited co… | ||||
| CVE-2025-62393US | medium4.3 | — | ||
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses… | ||||
| CVE-2025-54869US | — | — | ||
FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
- Moodle Security Announcements vom 2025-10-13external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan