CVE-2025-62397 - Vulnerability Details - OpenCVE

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Moodle	Moodle

No data.

No data.

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2025-62397
https://bugzilla.redhat.com/show_bug.cgi?id=2404430

History

Fri, 24 Oct 2025 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Moodle Moodle moodle
Vendors & Products		Moodle Moodle moodle

Thu, 23 Oct 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 23 Oct 2025 11:45:00 +0000

Type	Values Removed	Values Added
Description		The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
Title		Moodle: router produces json instead of 404 error for invalid course id
Weaknesses		CWE-209
References		https://access.redhat.com/security/cve/CVE-2025-62397 https://bugzilla.redhat.com/show_bug.cgi?id=2404430
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2025-10-23T11:28:33.922Z

Updated: 2025-10-23T14:12:29.386Z

Reserved: 2025-10-13T10:12:30.925Z

Link: CVE-2025-62397

Vulnrichment

Updated: 2025-10-23T14:12:25.820Z

NVD

Status : Received

Published: 2025-10-23T12:15:32.270

Modified: 2025-10-23T12:15:32.270

Link: CVE-2025-62397

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62397", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "state": "PUBLISHED", "assignerShortName": "fedora", "dateReserved": "2025-10-13T10:12:30.925Z", "datePublished": "2025-10-23T11:28:33.922Z", "dateUpdated": "2025-10-23T14:12:29.386Z"}, "containers": {"cna": {"title": "Moodle: router produces json instead of 404 error for invalid course id", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "The router\u2019s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance."}], "affected": [{"versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.3", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-62397", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404430", "name": "RHBZ#2404430", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2025-10-14T04:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "description": "Generation of Error Message Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-209: Generation of Error Message Containing Sensitive Information", "timeline": [{"lang": "en", "time": "2025-10-16T14:28:54.803000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-10-14T04:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Adam Jenkins for reporting this issue."}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2025-10-23T11:28:33.922Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-23T14:12:21.754220Z", "id": "CVE-2025-62397", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-23T14:12:29.386Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62397", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-23T14:12:21.754220Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-23T14:12:25.820Z"}}], "cna": {"title": "Moodle: router produces json instead of 404 error for invalid course id", "credits": [{"lang": "en", "value": "Red Hat would like to thank Adam Jenkins for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.3", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-16T14:28:54.803000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-10-14T04:00:00+00:00", "value": "Made public."}], "datePublic": "2025-10-14T04:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-62397", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404430", "name": "RHBZ#2404430", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "The router\u2019s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "Generation of Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2025-10-23T11:28:33.922Z"}, "x_redhatCweChain": "CWE-209: Generation of Error Message Containing Sensitive Information"}}, "cveMetadata": {"cveId": "CVE-2025-62397", "state": "PUBLISHED", "dateUpdated": "2025-10-23T14:12:29.386Z", "dateReserved": "2025-10-13T10:12:30.925Z", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "datePublished": "2025-10-23T11:28:33.922Z", "assignerShortName": "fedora"}, "dataVersion": "5.1"}