CVE-2025-62397: Moodle: router produces json instead of 404 error for invalid course id
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
Other sources
When supplied with non-existent course IDs, the router returned JSON data instead of a standard 404 response. This discrepancy enables attackers to distinguish between valid and invalid course identifiers, facilitating user enumeration or reconnaissance.
Versions affected: 5.0 to 5.0.2 Versions fixed: 5.0.3
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62397?
CVE-2025-62397 is a moderate severity vulnerability that allows attackers to infer existing course IDs.
How do I fix CVE-2025-62397?
To fix CVE-2025-62397, ensure that your Moodle installation is updated to the latest secure version provided by the vendor.
Who is affected by CVE-2025-62397?
CVE-2025-62397 affects users of the Moodle platform, particularly those utilizing its course management features.
What type of vulnerability is CVE-2025-62397?
CVE-2025-62397 is an information disclosure vulnerability that stems from inconsistent responses to invalid course IDs.
What can an attacker achieve through CVE-2025-62397?
An attacker can use CVE-2025-62397 to perform reconnaissance and discover valid course IDs within the Moodle platform.