CVE-2025-53021mediumCWE-384

CVE-2025-53021: falha de média gravidade em Moodle

Publicada em

Seguir esta CVE+ Monitorar moodle+ Monitorar moodle/moodle

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.2epss 0.4%
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
Moodle · Moodle
CVEs relacionadas — Moodle

No mesmo produto, das mais perigosas para as menos.

CVE-2012-1168—CVE-2012-1168EPSS 2.3%CVE-2012-1156—CVE-2012-1156EPSS 2.1%CVE-2012-1155—CVE-2012-1155EPSS 2.1%CVE-2012-1169—CVE-2012-1169EPSS 1.8%CVE-2012-1159—CVE-2012-1159EPSS 1.4%CVE-2012-1161—CVE-2012-1161EPSS 1.4%