CVE-2025-62397
Moodle: router produces json instead of 404 error for invalid course id
Summary
Moodle: router produces json instead of 404 error for invalid course id
Original description
The description as published by the source.
The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.
Affected packages
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.0.3"}]}]
References
- advisory access.redhat.com
- advisory nvd.nist.gov
- advisory github.com
- report bugzilla.redhat.com
- web git.moodle.org