BIT-moodle-2025-3640

vendorUSosv

Moodle: idor in web service allows users enrolled in a course to access some details of other users

Advisory ansehen veröffentlicht 2026-01-26Lizenz: per source

A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2025-3640US	—	0.39% (33rd)	—	2025-04-25
A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

https://access.redhat.com/security/cve/CVE-2025-3640ADVISORY
https://bugzilla.redhat.com/show_bug.cgi?id=2359734REPORT
https://moodle.org/mod/forum/discuss.php?d=467601ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2025-3640WEB

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan