CVE Explorer
CVE-2025-67848
A flaw was found in Moodle. This authentication bypass vulnerability allows suspended users to authenticate through the Learning Tools Interoperability (LTI) Provider. The issue arises from the LTI authentication handlers failing to enforce the user's suspension status, enabling unauthorized access to the system. This can lead to information disclosure or other unauthorized actions by users who should be restricted.
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://github.com/moodle/moodle/","defaultStatus":"unaffected","packageName":"moodle","versions":[{"lessThan":"4.1.22","status":"affected","version":"4.1.0","versionType":"semver"},{"lessThan":"4.4.12","status":"affected","version":"4.4.0","versionType":"semver"},{"lessThan":"4.5.8","status":"affected","version":"4.5.0","versionType":"semver"},{"lessThan":"5.0.4","status":"affected","version":"5.0.0","versionType":"semver"},{"lessThan":"5.1.1","status":"affected","version":"5.1.0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:d56fca6ae28dd578369728c62e4f0bdb17f746633c86efeddf12d94cc4a40c8c · sha256:eac80b1e808d94c7… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:d56fca6ae28dd578369728c62e4f0bdb17f746633c86efeddf12d94cc4a40c8c · sha256:eac80b1e808d94c7… · /containers/cna/metrics/1/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-280","description":"Improper Handling of Insufficient Permissions or Privileges","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:d56fca6ae28dd578369728c62e4f0bdb17f746633c86efeddf12d94cc4a40c8c · sha256:eac80b1e808d94c7… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-67848"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d56fca6ae28dd578369728c62e4f0bdb17f746633c86efeddf12d94cc4a40c8c · sha256:eac80b1e808d94c7… · /containers/cna/references/0
{"name":"RHBZ#2423831","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423831"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d56fca6ae28dd578369728c62e4f0bdb17f746633c86efeddf12d94cc4a40c8c · sha256:eac80b1e808d94c7… · /containers/cna/references/1
{"url":"https://moodle.org/mod/forum/discuss.php?d=471298"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:d56fca6ae28dd578369728c62e4f0bdb17f746633c86efeddf12d94cc4a40c8c · sha256:eac80b1e808d94c7… · /containers/cna/references/2
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.