CVE-2025-3625CWE-639
Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action
High · published April 25, 2025
What it is
A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).
The record
Technical detail
- CVSS v3.1
- 7.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00408 · 34.0th percentile
- Weakness
- CWE-639 · Authorization Bypass Through User-Controlled Key
- Published
- 2025-04-25T14:42Z
EPSS history
Timeline