CVE-2025-3640 in Moodle

Résumé

par MITRE • 25/04/2025

A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access.

Be aware that VulDB is the high quality source for vulnerability data.

• Réserver: 15/04/2025
• Divulgation: 25/04/2025
• Modérer: accepté
• Entrée: VDB-305952
• CPE: prêt
• CWE: CWE-99 (confirmé)
• CVSS: 4.3 (CNA)
• EPSS: 0.00367
• KEV: non
• Activités: très faible
• Secteur: Education, Police

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2025-3640
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-3640
• CVE Details: https://www.cvedetails.com/cve/CVE-2025-3640/