CVE-2025-3627

MEDIUM4.3EPSS 0.10%

Moodle makes some user data available before completing second factor with MFA enabled

發布日:2025/4/25修改日:2026/1/26

也稱為:GHSA-x45j-jq9q-gf3qBIT-moodle-2025-3627

描述

A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication (2FA).

受影響套件(2)

Bitnami/moodle>= 4.3.0, < 4.3.12, >= 4.4.0, < 4.4.8, >= 4.5.0, < 4.5.4
Packagist/moodle/moodle>= 4.3.0-beta, < 4.3.12

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-3627
PATCHhttps://github.com/moodle/moodle
WEBhttps://access.redhat.com/security/cve/CVE-2025-3627
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2359692
WEBhttps://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84351&type=commits
WEBhttps://moodle.org/mod/forum/discuss.php?d=467594