CVE-2025-62395
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Oct 23, 2025
CISA due date
—
The record
A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | moodle | 4.1.0 | 4.1.21 |
Related vulnerabilities
- GHSA-25wf-7x6c-wmpf Moodle does not properly enforce MFA Also affects moodle
- GHSA-422v-w6c5-vq42 Moodle exposed the names of hidden groups to users Also affects moodle
- GHSA-c5cj-xp43-qcc3 Moodle's error handling leads to sensitive information disclosure Also affects moodle
- GHSA-m58f-9pvv-8mp2 Moodle vulnerable to brute-force password guesses Also affects moodle
- GHSA-w29j-8phw-ffjf Moodle has a time restriction bypass Also affects moodle
- GHSA-8fcv-4qp9-pg32 Moodle sends quiz-related messages to inactive/suspended users Also affects moodle
- GHSA-rjcm-7v2p-9265 Moodle course access permissions are not properly checked in… Also affects moodle
- CVE-2025-62397 The router’s inconsistent response to invalid course IDs allowed attackers to infer which… Also affects moodle