CVE-2025-62398
BaseFortify
Publication date: 2025-10-23
Last updated on: 2025-11-14
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moodle | moodle | From 4.4.0 (inc) to 4.4.11 (exc) |
| moodle | moodle | From 4.5.0 (inc) to 4.5.7 (exc) |
| moodle | moodle | From 5.0.0 (inc) to 5.0.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-62398 is a high-severity vulnerability in Moodle that allows attackers with valid credentials to bypass multi-factor authentication (MFA) during login. This happens because certain login endpoints do not properly enforce MFA validation, enabling users who provide valid usernames and passwords to access accounts without completing the required second-factor authentication. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access to user accounts even if MFA is enabled, potentially compromising sensitive information and user data. Attackers who have valid credentials can bypass the second authentication factor, increasing the risk of account takeover and data breaches. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves verifying if your Moodle installation is running a vulnerable version (5.0 to 5.0.2, 4.5 to 4.5.6, or 4.4 to 4.4.10). You can check the Moodle version by running the command: `grep '$release' /path/to/moodle/version.php`. Additionally, monitoring login attempts that bypass MFA could be done by analyzing web server logs for successful logins without second-factor authentication. However, no specific detection commands are provided. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediately upgrade Moodle to a fixed version: 5.0.3, 4.5.7, or 4.4.11, depending on your current version. Until the upgrade is applied, consider restricting access to login endpoints or enforcing additional access controls to prevent MFA bypass. Also, monitor user accounts for suspicious activity. [1]