Bug 2359692 (CVE-2025-3627) - CVE-2025-3627 moodle: Partial Data Exposure in Moodle Before Completing Multi-Factor Authentication
Summary: CVE-2025-3627 moodle: Partial Data Exposure in Moodle Before Completing Multi...
Keywords:
Status: NEW
Alias: CVE-2025-3627
Deadline: 2025-04-22
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2361789 2361790
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-15 07:39 UTC by OSIDB Bzimport
Modified: 2025-04-22 22:19 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-15 07:39:05 UTC 
On sites with Multi-Factor Authentication enabled, it was possible for a user to access some of their data  after passing only the first login factor (such as passing a username/password check). The user should have to also pass a second factor check before gaining access to that data.

Versions affected: 4.5 to 4.5.3, 4.4 to 4.4.7 and 4.3 to 4.3.11
Versions fixed:    4.5.4, 4.4.8 and 4.3.12
Note You need to log in before you can comment on or make changes to this bug.