CVE-2025-67857: Moodle: moodle: data exposure of user identifiers in urls
A data exposure issue existed where user identifiers were visible in URLs during anonymous assignment submissions, contrary to expected anonymity protections. This could reveal internal IDs to unauthorized viewers.
Other sources
A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized viewers to see internal user IDs, compromising the intended anonymity and potentially leading to information disclosure.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67857?
The severity of CVE-2025-67857 is considered moderate due to potential data exposure of user identifiers.
How do I fix CVE-2025-67857?
To fix CVE-2025-67857, upgrade Moodle to version 5.1.1, 5.0.4, 4.5.8, 4.4.12, or 4.1.22.
What kind of data is exposed in CVE-2025-67857?
CVE-2025-67857 exposes user identifiers in URLs during anonymous assignment submissions.
Who is affected by CVE-2025-67857?
Users of Moodle versions prior to the patched versions mentioned are affected by CVE-2025-67857.
What impact does CVE-2025-67857 have on user privacy?
CVE-2025-67857 compromises user privacy by revealing internal user IDs to unauthorized viewers.