Search for vulnerabilities
Vulnerability details: VCID-yech-qku7-tyht
Vulnerability ID VCID-yech-qku7-tyht
Aliases CVE-2025-3647
GHSA-34g7-pg9j-pxgp
Summary Moodle allows IDOR when accessing the cohorts report A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-863 Incorrect Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 4.3 https://access.redhat.com/security/cve/CVE-2025-3647
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2025-3647
ssvc Track https://access.redhat.com/security/cve/CVE-2025-3647
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-3647
epss 0.00037 https://api.first.org/data/v1/epss?cve=CVE-2025-3647
cvssv3.1 4.3 https://bugzilla.redhat.com/show_bug.cgi?id=2359762
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2359762
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2359762
cvssv3.1 4.3 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 4.3 https://github.com/moodle/moodle/commit/bd6ec0ac84cf0f73ab35e7e244e1f9b06929083a
generic_textual MODERATE https://github.com/moodle/moodle/commit/bd6ec0ac84cf0f73ab35e7e244e1f9b06929083a
cvssv3.1 4.3 https://moodle.org/mod/forum/discuss.php?d=467607
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=467607
ssvc Track https://moodle.org/mod/forum/discuss.php?d=467607
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2025-3647
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-3647
Reference id Reference type URL
https://access.redhat.com/security/cve/CVE-2025-3647
https://api.first.org/data/v1/epss?cve=CVE-2025-3647
https://bugzilla.redhat.com/show_bug.cgi?id=2359762
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/bd6ec0ac84cf0f73ab35e7e244e1f9b06929083a
https://moodle.org/mod/forum/discuss.php?d=467607
https://nvd.nist.gov/vuln/detail/CVE-2025-3647
GHSA-34g7-pg9j-pxgp https://github.com/advisories/GHSA-34g7-pg9j-pxgp
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/security/cve/CVE-2025-3647
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T15:42:45Z/ Found at https://access.redhat.com/security/cve/CVE-2025-3647
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359762
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T15:42:45Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359762
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/bd6ec0ac84cf0f73ab35e7e244e1f9b06929083a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=467607
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T15:42:45Z/ Found at https://moodle.org/mod/forum/discuss.php?d=467607
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-3647
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.07301
EPSS Score 0.00031
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:12:07.978896+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-34g7-pg9j-pxgp/GHSA-34g7-pg9j-pxgp.json 36.1.3