CVE-2025-62401: Moodle has a time restriction bypass
An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
Other sources
An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
— MITRE
The timed assignment feature had a flaw that allowed users to avoid time-based restrictions through specific behavior or requests. This could result in unfair assessment conditions and integrity concerns.
Versions affected: 5.0 to 5.0.2, 4.5 to 4.5.6, 4.4 to 4.4.10, 4.1 to 4.1.20 and earlier unsupported versions Versions fixed: 5.0.3, 4.5.7, 4.4.11 and 4.1.21
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.21 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.11 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 5.0.3 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 5.0.3 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.4.11 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.1.21
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62401?
CVE-2025-62401 is considered a moderate severity vulnerability due to its potential to allow students access to extra time for completing assessments.
How do I fix CVE-2025-62401?
To fix CVE-2025-62401, update your Moodle installation to the latest version where this issue is resolved.
What systems are affected by CVE-2025-62401?
CVE-2025-62401 affects all versions of Moodle that utilize the timed assignment feature.
What kind of exploit does CVE-2025-62401 facilitate?
CVE-2025-62401 facilitates the exploitation of the timed assignment feature, allowing students to bypass the time restrictions set for assessments.
Is there a workaround for CVE-2025-62401 while waiting for a patch?
Currently, the best approach for CVE-2025-62401 is to monitor for official updates or patches from Moodle regarding this vulnerability.