« Volver al listado

CVE-2025-3636

Estado: AnalizadaMedia (4.3)—

A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Moodle — Moodle

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-3636",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-3636",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-25T15:43:06.661207Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "patrick@puiterwijk.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "patrick@puiterwijk.org",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "4.5.0",
              "lessThan": "4.5.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.4.0",
              "lessThan": "4.4.8",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.3.0",
              "lessThan": "4.3.12",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.1.0",
              "lessThan": "4.1.18",
              "versionType": "semver"
            }
          ],
          "packageName": "moodle",
          "collectionURL": "https://git.moodle.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-25T15:15:37.363",
  "references": [
    {
      "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84499",
      "tags": [
        "Patch"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2025-3636",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2359726",
      "tags": [
        "Issue Tracking"
      ],
      "source": "patrick@puiterwijk.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "patrick@puiterwijk.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks."
    },
    {
      "lang": "es",
      "value": "Se detectó una falla en Moodle. Esta vulnerabilidad permite a usuarios no autorizados acceder y ver las fuentes RSS debido a comprobaciones de capacidad insuficientes."
    }
  ],
  "lastModified": "2026-06-17T09:20:21.857",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "245F0D61-A209-4129-AEA5-C8E1600F5202",
              "versionEndExcluding": "4.1.18"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF438B80-5736-46ED-897E-726B563F8E0A",
              "versionEndExcluding": "4.3.12",
              "versionStartIncluding": "4.3.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E758F51B-ADBF-406E-92A8-98090BE83C2B",
              "versionEndExcluding": "4.4.8",
              "versionStartIncluding": "4.4.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F12B5C6F-A83C-488C-9C26-3C9A61F93618",
              "versionEndExcluding": "4.5.4",
              "versionStartIncluding": "4.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org"
}