CVE-2025-3625

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
—	—	>= 4.5.0, < 4.5.4; >= 4.4.0, < 4.4.8; >= 4.3.0, < 4.3.12

References

https://access.redhat.com/security/cve/CVE-2025-3625Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2359690Issue Tracking

Timeline

Published: Apr 25, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-362509.8IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to CVE-2025-362519.8IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary comm CVE-2025-362526.3IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could CVE-2025-362537.5IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive CVE-2025-362547.4IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass securi CVE-2025-362558.8IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to cre CVE-2025-362585.5IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text wh CVE-2025-36269.1A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in CVE-2025-362624.9IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to ga CVE-2025-36274.3A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they fi CVE-2025-362715.9IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to CVE-2025-362747.5IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an un