CVE-2025-62397

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-62397
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62397.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-62397
Aliases
Downstream
Published
2025-10-23T11:28:33.922Z
Modified
2026-07-15T01:49:06.181024038Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Moodle: router produces json instead of 404 error for invalid course id
Details

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62397.json",
    "cwe_ids": [
        "CWE-209"
    ],
    "cna_assigner": "fedora",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "5.0.0"
                },
                {
                    "fixed": "5.0.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/moodle/moodle

Affected ranges

Type
GIT
Repo
https://github.com/moodle/moodle
Events
Introduced
78e860178314c45441a21e0b99455400b8283d48
Fixed
1b2d270397613a3889a24f59be0ee6d0292a7556
Database specific 
{
    "cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.0.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v5.*
v5.0.0
v5.0.1
v5.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62397.json"