CVE-2025-62397
CVE-2025-62397 · Moodle: router produces json instead of 404 error for invalid course id
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
CVSS 5.3 · Medium · EPSS 0.3%
- Published
- Updated
Stack: system
Affected products and versions
moodle Ubuntu:Pro:16.04:LTS
- Versions
- 2.7.9+dfsg-1
- 2.7.10+dfsg-1
- 2.7.11+dfsg-1
- 2.7.11+dfsg-2
- 2.7.12+dfsg-1
- 3.0.3+dfsg-0ubuntu1
- 3.0.3+dfsg-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
moodle Ubuntu:Pro:18.04:LTS
- Versions
- 3.0.3+dfsg-0ubuntu1
- 3.0.3+dfsg-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published