PT-2025-17915 · Moodle+2 · Moodle+2

Khikhi · Published 2025-04-22 · Updated 2026-01-26 · CVE-2025-3640

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Moodle (affected versions not specified)

Description A flaw was found in the software, where insufficient capability checks allowed a user enrolled in a course to access certain details of other users they did not have permission to access, such as the full name and profile image URL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

ALT-PU-2025-6924

ALT-PU-2025-7344

BDU:2025-05103

BIT-MOODLE-2025-3640

CVE-2025-3640

GHSA-6G5X-H5X7-Q4MQ

Affected Products

Alt Linux

Moodle

Red Os

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2025-3640 · Security Note
• https://osv.dev/vulnerability/GHSA-6g5x-h5x7-q4mq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-moodle-2025-3640 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=467601 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-3640 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-3640 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05103 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-3640 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-3640 · Vendor Advisory
• https://github.com/moodle/moodle · Note
• https://github.com/moodle/moodle/commit/64a4311266cbe9a9a942c836931bef224018b77d · Note
• https://twitter.com/VulmonFeeds/status/1915819558331470090 · Twitter Post
• https://moodle.org/security · Note
• https://twitter.com/CVEnew/status/1915780616873709591 · Twitter Post