Nixpkgs security tracker

Login with GitHub

Details of issue NIXPKGS-2026-0040

NIXPKGS-2026-0040

published on

Permalink CVE-2025-62397

5.3 MEDIUM

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): LOW
Integrity impact (I): NONE
Availability impact (A): NONE

updated 2 months, 3 weeks ago by @LeSuisse Activity log

Created automatic suggestion 4 months, 2 weeks ago
@LeSuisse removed package moodle-dl 2 months, 3 weeks ago
@LeSuisse removed
2 maintainers
- @kmein
- @freezeboy
2 months, 3 weeks ago
@LeSuisse accepted 2 months, 3 weeks ago
@LeSuisse published on GitHub 2 months, 3 weeks ago

Moodle: router produces json instead of 404 error for invalid course id

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.

References

https://access.redhat.com/security/cve/CVE-2025-62397 x_refsource_REDHATvdb-entry
RHBZ#2404430 issue-trackingx_refsource_REDHAT

Affected products

moodle

<5.0.3

Matching in nixpkgs

pkgs.moodle

Free and open-source learning management system (LMS) written in PHP

nixos-unstable 5.0.2
- nixpkgs-unstable 5.0.2
- nixos-unstable-small 5.0.2

Package maintainers

Ignored maintainers (1)

@freezeboy freezeboy