CVE-2025-62395

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-23

Last updated on: 2025-11-14

Assigner: Fedora Project

Description

A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-23

Last Modified

2025-11-14

Generated

2026-07-06

AI Q&A

2025-10-23

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62395

EUVD

EUVD-2025-35666

Affected Vendors & Products

Vendor	Product	Version / Range
moodle	moodle	From 4.1.0 (inc) to 4.1.21 (exc)
moodle	moodle	From 4.4.0 (inc) to 4.4.11 (exc)
moodle	moodle	From 4.5.0 (inc) to 4.5.7 (exc)
moodle	moodle	From 5.0.0 (inc) to 5.0.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Moodle's external cohort search service allows users who have permissions in lower contexts to bypass proper checks and access cohort information from the higher-level system context. This means that a user with permission to manage cohorts locally can enumerate or access restricted administrative data from system cohorts, which should normally be inaccessible to them. [1]

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive administrative information by allowing users with limited permissions to access higher-level cohort data. This exposure could result in information leakage, potentially compromising the confidentiality of administrative data within the Moodle system. [1]

Mitigation Strategies

To mitigate this vulnerability, immediately upgrade Moodle to a fixed version: 5.0.3, 4.5.7, 4.4.11, or 4.1.21 or later. These versions contain the fix for the cohort search service flaw that improperly enforces context-based capability checks. [1]

Hi! I’m here to help you understand CVE-2025-62395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70