CVE-2025-3640
CVSS 3.1 Score 4.3 of 10 (medium)
Details
Published Apr 25, 2025
Updated: Apr 29, 2025
CWE ID 639
Summary
CVE-2025-3640 is a vulnerability affecting the Moodle learning management system. This issue stems from insufficient capability checks, which allow users enrolled in a course to gain unauthorized access to sensitive information. Specifically, they can view the full names and profile image URLs of other users they should not be able to access. This flaw poses a potential risk to user privacy and security within affected Moodle installations. Users are advised to apply the necessary patches or updates to mitigate this vulnerability.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.