CVE-2025-3625: Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action
A missing check in the Multi-Factor Authentication (MFA) email factor's revoke/cancel action could allow an attacker to revoke a user's only available second authentication factor. This could prevent the user from successfully logging in (denial of service), and also disclose their name in the process via an Insecure Direct Object Reference (IDOR) vulnerability.
Versions affected: 4.5 to 4.5.3, 4.4 to 4.4.7, and 4.3 to 4.3.11 Versions fixed: 4.5.4, 4.4.8, and 4.3.12
Other sources
A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication (2FA).
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3625?
CVE-2025-3625 is classified as a significant security vulnerability due to its potential for denial of service.
How do I fix CVE-2025-3625?
To mitigate CVE-2025-3625, update to the latest version of Moodle that has patched the vulnerability.
What impact does CVE-2025-3625 have on users?
CVE-2025-3625 can prevent users from logging in by allowing an attacker to revoke their Multi-Factor Authentication email factor.
Is my version of Moodle affected by CVE-2025-3625?
Moodle versions 4.3.0 through 4.5.3 are affected by CVE-2025-3625.
How can I identify if I've been exploited by CVE-2025-3625?
Check user reports of login issues related to Multi-Factor Authentication as a potential indicator of exploitation of CVE-2025-3625.