GHSA-8jrv-wx83-w3xj
Moodle Inserts Sensitive Information Into Sent Data
At a glance
- Published
- Updated
- CVE
- CVE-2025-67857
- Aliases
- BIT-moodle-2025-67857
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Description
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 0, fixed 4.1.22 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.12 |
| Packagist · moodle/moodle | introduced 4.5.0-beta, fixed 4.5.8 |
| Packagist · moodle/moodle | introduced 5.0.0-beta, fixed 5.0.4 |
| Packagist · moodle/moodle | introduced 5.1.0-beta, fixed 5.1.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-67857 ADVISORY
- https://github.com/moodle/moodle/commit/ac30e7e19357f696979b7ffd760a7131b6ad88f6 WEB
- https://github.com/moodle/moodle/commit/c6cb8d971257c04a12a2c5d8510a89cb906f46f0 WEB
- https://access.redhat.com/security/cve/CVE-2025-67857 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2423868 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=471307 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |