← voltar
CVE-2025-67848

Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.

CVSS 8.1 HIGHEPSS 0.4%CWE-280
Vexday Risk Score
21Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 8.1EPSS 0.4%KEV nãoPoC Nuclei Metasploit Patch
Ciclo de vida
03 fev 2026Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
moodle

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →