PT-2025-26777 · Moodle+1 · Moodle+1
CVE-2025-53021
·
Publicado
2025-06-24
·
Atualizado
2025-08-22
CVSS v3.1
4.2
Média
| Vetor | AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Moodle versions 3.x through 3.11.18
Description:
A session fixation issue allows unauthenticated attackers to hijack user sessions via the
sesskey parameter. This parameter can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's, leading to full account takeover.Recommendations:
For Moodle versions 3.x through 3.11.18, as these versions are no longer supported by the maintainer, consider upgrading to a supported version to mitigate the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Session Fixation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Moodle
Red Os