CVE-2025-3627CWE-287

Moodle: partial data exposure in moodle before completing multi-factor authentication

Medium · published April 25, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication (2FA).

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2025-04-25T14:42Z
EPSS history
Timeline
  • 25 APR 14:42Z
    Moodle: partial data exposure in moodle before completing multi-factor authentication
    cvelistv5