GHSA-x45j-jq9q-gf3qMediumCVSS 4.3

Moodle makes some user data available before completing second factor with MFA enabled

Published
April 25, 2025
Last Modified
April 25, 2025

🔗 CVE IDs covered (1)

CVE-2025-3627 →

📋 Description

A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication (2FA).

🎯 Affected products3

  • composer/moodle/moodle:>= 4.3.0-beta, < 4.3.12
  • composer/moodle/moodle:>= 4.4.0-beta, < 4.4.8
  • composer/moodle/moodle:>= 4.5.0-beta, < 4.5.4

🔗 References (6)