CVE-2025-3625 HIGH

CVE-2025-3625: Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action

Weakness CWE-639 · IDOR
Published April 25, 2025
Last update April 25, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

What the vulnerability does

01Description

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

Key dates

02Disclosure timeline

April 25, 2025 CVE published
April 25, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-45349 Open WebUI: Broken Access Control for Completions API CVE-2025-59133 WordPress Projectopia plugin <= 5.1.25.2 - Insecure Direct Object References (IDOR) vulnerability CVE-2023-3700 Authorization Bypass Through User-Controlled Key in alextselegidis/easyappointments CVE-2024-12131 WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference CVE-2022-4803 Authorization Bypass Through User-Controlled Key in usememos/memos