CVE-2025-3625 — Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action

CVE-2025-3625

Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action PUBLISHED

Description (CNA)

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

Affected (CNA)

Vendor / product	Versions
Not supplied / Not supplied	affected 4.5.0 before 4.5.4; affected 4.4.0 before 4.4.8; affected 4.3.0 before 4.3.12

CWE

CWE-639

References

https://access.redhat.com/security/cve/CVE-2025-3625
https://bugzilla.redhat.com/show_bug.cgi?id=2359690

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.