Skip to content
OpenAdvisories
High WID-SEC-2025-2272 10 CVEs

Moodle: Mehrere Schwachstellen

Published Oct 13, 2025 · Updated Oct 23, 2025 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.

Product

Moodle ist ein Software-Paket, um internetbasierte Kurse zu entwickeln und durchzuführen. Es ist ein globales Softwareentwicklungsprojekt, das einen konstruktivistischen Lehr- und Lernansatz unterstützt.

Vulnerabilities 10

  • High 7.5
    CVE-2025-62399

    Moodle: password brute force risk when mobile/web services enabled

    Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.0
    CVE-2025-54869

    FPDI is Vulnerable to Memory Exhaustion (OOM) through its PDF Parser

    FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF. In versions 2.6.2 and below, any application that uses FPDI to process user-supplied PDF files is at risk, causing a Denial of S…

    Setasign FPDI setasign/fpdi icingaweb2-module-pdfexport Debian Ubuntu Packagist
  • Medium 5.4
    CVE-2025-62398

    Moodle: possible to bypass mfa

    A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2025-62401

    Moodle: possible to bypass timer in timed assignments

    An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2025-62396

    Moodle: router (r.php) could expose application directories

    An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2025-62397

    Moodle: router produces json instead of 404 error for invalid course id

    The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-62393

    Moodle: course access permissions not properly checked in course_output_fragment_course_overview

    A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2025-62394

    Moodle: quiz notifications sent to suspended participants

    Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2025-62395

    Moodle: external cohort search service leaks system cohort data

    A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2025-62400

    Moodle: hidden group names visible to event creators

    Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.

    moodle/moodle moodle Web / CMS Ubuntu Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2025-35669, EUVD-2025-35666, EUVD-2025-35667, EUVD-2025-35668, EUVD-2025-35670, EUVD-2025-35671, EUVD-2025-35672, EUVD-2025-35673

  2. #1

    Initiale Fassung

References