CVE-2025-62778 - Vulnerability Details - OpenCVE

Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Frappe	Frappe Frappe Lms

No data.

No data.

References

Link	Providers
https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750
https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx

History

Tue, 28 Oct 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 28 Oct 2025 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Frappe Frappe frappe Frappe frappe Lms
Vendors & Products		Frappe Frappe frappe Frappe frappe Lms

Mon, 27 Oct 2025 21:30:00 +0000

Type	Values Removed	Values Added
Description		Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.
Title		Frappe Learning allowed students to access the Quiz Form via direct URL
Weaknesses		CWE-425
References		https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750 https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx
Metrics		cvssV4_0 `{'score': 1.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-10-27T21:16:06.220Z

Updated: 2025-10-28T13:38:07.740Z

Reserved: 2025-10-22T18:55:48.006Z

Link: CVE-2025-62778

Vulnrichment

Updated: 2025-10-28T13:16:48.572Z

NVD

Status : Received

Published: 2025-10-27T22:15:41.873

Modified: 2025-10-27T22:15:41.873

Link: CVE-2025-62778

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62778", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-22T18:55:48.006Z", "datePublished": "2025-10-27T21:16:06.220Z", "dateUpdated": "2025-10-28T13:38:07.740Z"}, "containers": {"cna": {"title": "Frappe Learning allowed students to access the Quiz Form via direct URL", "problemTypes": [{"descriptions": [{"cweId": "CWE-425", "lang": "en", "description": "CWE-425: Direct Request ('Forced Browsing')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 1.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx"}, {"name": "https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750", "tags": ["x_refsource_MISC"], "url": "https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750"}], "affected": [{"vendor": "frappe", "product": "lms", "versions": [{"version": "<= 2.39.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-27T21:16:06.220Z"}, "descriptions": [{"lang": "en", "value": "Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL."}], "source": {"advisory": "GHSA-8xvv-6v89-xxgx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-28T13:16:46.371405Z", "id": "CVE-2025-62778", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-28T13:38:07.740Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62778", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-28T13:16:46.371405Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-28T13:16:48.572Z"}}], "cna": {"title": "Frappe Learning allowed students to access the Quiz Form via direct URL", "source": {"advisory": "GHSA-8xvv-6v89-xxgx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "frappe", "product": "lms", "versions": [{"status": "affected", "version": "<= 2.39.1"}]}], "references": [{"url": "https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx", "name": "https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750", "name": "https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-425", "description": "CWE-425: Direct Request ('Forced Browsing')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-27T21:16:06.220Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62778", "state": "PUBLISHED", "dateUpdated": "2025-10-28T13:38:07.740Z", "dateReserved": "2025-10-22T18:55:48.006Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-27T21:16:06.220Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL."}], "id": "CVE-2025-62778", "lastModified": "2025-10-27T22:15:41.873", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2025-10-27T22:15:41.873", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/frappe/lms/commit/8749e21744547ae32f729bde05c854113e126750"}, {"source": "security-advisories@github.com", "url": "https://github.com/frappe/lms/security/advisories/GHSA-8xvv-6v89-xxgx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-425"}], "source": "security-advisories@github.com", "type": "Primary"}]}