CVE-2025-67857
Information Disclosure in Moodle Due to Anonymous Submission URL Exposure
Publication date: 2026-02-03
Last updated on: 2026-02-11
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moodle | moodle | From 4.4.0 (inc) to 4.4.11 (exc) |
| moodle | moodle | to 4.1.21 (exc) |
| moodle | moodle | From 4.5.0 (inc) to 4.5.8 (exc) |
| moodle | moodle | From 5.0.0 (inc) to 5.0.4 (exc) |
| moodle | moodle | 5.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-201 | The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Moodle causes user identifiers to be exposed in URLs during anonymous assignment submissions. This means that internal user IDs, which should remain anonymous, are visible to unauthorized viewers, compromising user anonymity. [1]
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of sensitive user identification information. This compromises the anonymity of users submitting assignments anonymously, potentially exposing their identities to unintended parties. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by monitoring network traffic or web server logs for URLs containing user identifiers during anonymous assignment submissions in Moodle. For example, use commands like 'grep' on web server access logs to search for patterns that include user IDs in URLs. Additionally, network packet capture tools like 'tcpdump' or 'Wireshark' can be used to inspect HTTP requests for exposed user identifiers in URLs. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to assignment submission URLs to authorized users only, monitoring and auditing web server logs for suspicious access, and informing users about the potential exposure. Since no fixed version or patch is specified, consider applying access controls or temporary URL rewriting rules to prevent user identifiers from being exposed in URLs until an official fix is released. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability exposes internal user identifiers during anonymous assignment submissions, compromising anonymity and potentially leading to unauthorized disclosure of personal data. This exposure could violate data protection principles required by regulations such as GDPR and HIPAA, which mandate safeguarding personal information and ensuring user privacy. [1]