GitHub Advisoryadvisory · Packagist

GHSA-8jrv-wx83-w3xj Moodle Inserts Sensitive Information Into Sent Data

MEDIUM Published 2026-02-03 Modified 2026-02-03 Official page ↗
Aliases
CVE-2025-67857
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-201
Reviewed
2026-02-03

Affected packages

• Packagist moodle/moodle: < 4.1.22 → fixed in 4.1.22 • Packagist moodle/moodle: >= 4.4.0-beta, < 4.4.12 → fixed in 4.4.12 • Packagist moodle/moodle: >= 4.5.0-beta, < 4.5.8 → fixed in 4.5.8 • Packagist moodle/moodle: >= 5.0.0-beta, < 5.0.4 → fixed in 5.0.4 • Packagist moodle/moodle: >= 5.1.0-beta, < 5.1.1 → fixed in 5.1.1

Description

A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References