CVE-2025-62397
Medium · 5.3CVSS
5.3
EPSS
0.3%
Published
Oct 23, 2025
CISA due date
—
The record
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Bitnami | moodle | 5.0.0 | 5.0.3 |
Related vulnerabilities
- GHSA-25wf-7x6c-wmpf Moodle does not properly enforce MFA Also affects moodle
- GHSA-422v-w6c5-vq42 Moodle exposed the names of hidden groups to users Also affects moodle
- GHSA-c5cj-xp43-qcc3 Moodle's error handling leads to sensitive information disclosure Also affects moodle
- GHSA-m58f-9pvv-8mp2 Moodle vulnerable to brute-force password guesses Also affects moodle
- GHSA-w29j-8phw-ffjf Moodle has a time restriction bypass Also affects moodle
- GHSA-8fcv-4qp9-pg32 Moodle sends quiz-related messages to inactive/suspended users Also affects moodle
- GHSA-rjcm-7v2p-9265 Moodle course access permissions are not properly checked in… Also affects moodle
- CVE-2025-62395 A flaw in the cohort search web service allowed users with permissions in lower contexts… Also affects moodle