This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Moodle fixes 10 vulnerabilities

Moodle versions 5.0.3, 4.5.7, 4.4.11 and 4.1.21 fix 10 vulnerabilities. The most severe ones are described below, the rest can be found at [1].

Moodle - MFA bypass (CVE-2025-62398)
CVSS 5.4 (Medium)

Allows an authenticated remote attacker with valid credentials to bypass multi-factor authentication under certain conditions, which could lead to compromise of user accounts [2].

The vulnerability is present in product:

  • Moodle; >=5.0, <=5.0.2; >=4.5, <=4.5.6; >=4.4, <=4.4.10

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

More information:

The vulnerability was publicly disclosed 14. 10. 2025.

Moodle - DoS (CVE-2025-54869)
CVSS 6.0 (Medium)

Allows an authenticated remote attacker to perform a DoS attack by uploading a malicious PDF file [3].

The vulnerability is present in product:

  • Moodle; >=5.0, <=5.0.2; >=4.5, <=4.5.6; >=4.4, <=4.4.10; >=4.1, <=4.1.20

CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

More information:

The vulnerability was publicly disclosed 14. 10. 2025.

Moodle - password bruteforce (CVE-2025-62399)
CVSS 7.5 (High)

Allows a remote attacker to brute-force passwords of other user accounts when the mobile client and auth_webservice are enabled [4].

The vulnerability is present in product:

  • Moodle; >=5.0, <=5.0.2; >=4.5, <=4.5.6; >=4.4, <=4.4.10; >=4.1, <=4.1.20

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

More information:

The vulnerability was publicly disclosed 14. 10. 2025.

Moodle - privacy exposure (CVE-2025-62400)
CVSS 6.5 (Medium)

Allows an authenticated remote attacker with permission to create group events, but without permission to view hidden groups, to view hidden and separate groups in the calendar event selector due to insufficient permission checks [5].

The vulnerability is present in product:

  • Moodle; >=5.0, <=5.0.2; >=4.5, <=4.5.6; >=4.4, <=4.4.10; >=4.1,<=4.1.20

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 14. 10. 2025.

Moodle - misconfigured headers (CVE-2025-62396)
CVSS 5.3 (Medium)

Allows an unauthenticated remote attacker to view the application's directory structure due to improper error handling in the routing system when the Accept: text/html header is not configured [6].

The vulnerability is present in product:

  • Moodle; >=5.0, <=5.0.2; >=4.5, <=4.5.6

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 14. 10. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 22. 10. 2025.

CESNET, z.s.p.o. Logo