CVEvulnerability
CVE-2025-67857
5.3 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-02-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-201
Description
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.
Affected configurations
• moodle moodle (< 4.1.21)
• moodle moodle (>= 4.4.0 < 4.4.11)
• moodle moodle (>= 4.5.0 < 4.5.8)
• moodle moodle (>= 5.0.0 < 5.0.4)
• moodle moodle 5.1.0
Related
Weakness · CWE (1)
- CWE-201 Insertion of Sensitive Information Into Sent Data weakness
References
- https://access.redhat.com/security/cve/CVE-2025-67857 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2423868 Third Party Advisory
- https://moodle.org/mod/forum/discuss.php?d=471307 Vendor Advisory