CVE-2023-40325 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2023-40325

CVE-2023-40325

Published:May 15, 2026

Updated:May 15, 2026

moodle: quiz sequential navigation bypass possible

Affected Packages

moodle/moodle (PHP):

Affected version(s) >=v3.6.6 <v3.7.0-rc2

Fix Suggestion:

Update to version v3.7.0-rc2

moodle/moodle (PHP):

Affected version(s) >=v3.11.6 <v3.11.16

Fix Suggestion:

Update to version v3.11.16

moodle/moodle (PHP):

Affected version(s) >=v3.8.2 <v3.8.5

Fix Suggestion:

Update to version v3.8.5

moodle/moodle (PHP):

Affected version(s) >=v3.10.10 <v3.11.2

Fix Suggestion:

Update to version v3.11.2

moodle/moodle (PHP):

Affected version(s) =v3.7.0 <v3.7.1

Fix Suggestion:

Update to version v3.7.1

moodle/moodle (PHP):

Affected version(s) >=v4.0.0-rc2 <v4.0.10

Fix Suggestion:

Update to version v4.0.10

moodle/moodle (PHP):

Affected version(s) >=v3.9.13 <v3.9.15

Fix Suggestion:

Update to version v3.9.15

moodle/moodle (PHP):

Affected version(s) >=v3.4.3 <v3.4.5

Fix Suggestion:

Update to version v3.4.5

moodle/moodle (PHP):

Affected version(s) =dev-MOODLE_310_STABLE <dev-MOODLE_311_STABLE

Fix Suggestion:

Update to version dev-MOODLE_311_STABLE

moodle/moodle (PHP):

Affected version(s) >=v3.4.9 <v3.5.2

Fix Suggestion:

Update to version v3.5.2

moodle/moodle (PHP):

Affected version(s) >=v3.7.9 <v3.8.1

Fix Suggestion:

Update to version v3.8.1

drakeba/moodle-core (PHP):

Affected version(s) >=dev-bamaster <=4.1.1

Fix Suggestion:

Update to version no_fix

moodle/moodle (PHP):

Affected version(s) >=v3.7.3 <v3.7.8

Fix Suggestion:

Update to version v3.7.8

moodle/moodle (PHP):

Affected version(s) >=v3.3.6 <v3.3.8

Fix Suggestion:

Update to version v3.3.8

moodle/moodle (PHP):

Affected version(s) >=v3.9.16 <v3.9.23

Fix Suggestion:

Update to version v3.9.23

moodle/moodle (PHP):

Affected version(s) >=v3.5.8 <v3.6.0-beta

Fix Suggestion:

Update to version v3.6.0-beta

moodle/moodle (PHP):

Affected version(s) >=dev-MOODLE_33_STABLE <dev-MOODLE_39_STABLE

Fix Suggestion:

Update to version dev-MOODLE_39_STABLE

agattitech/moodle_boilerplate (PHP):

Affected version(s) >=dev-master <=3.9.20

Fix Suggestion:

Update to version no_fix

moodle/moodle (PHP):

Affected version(s) =v4.0.0-beta <v4.0.0-rc1

Fix Suggestion:

Update to version v4.0.0-rc1

moodle/moodle (PHP):

Affected version(s) =v3.6.4 <v3.6.5

Fix Suggestion:

Update to version v3.6.5

moodle/moodle (PHP):

Affected version(s) =v3.5.6 <v3.5.7

Fix Suggestion:

Update to version v3.5.7

moodle/moodle (PHP):

Affected version(s) >=v3.8.6 <v3.9.9

Fix Suggestion:

Update to version v3.9.9

moodle/moodle (PHP):

Affected version(s) >=v4.1.0-beta <v4.1.5

Fix Suggestion:

Update to version v4.1.5

moodle/moodle (PHP):

Affected version(s) >=v4.2.0-beta <v4.2.2

Fix Suggestion:

Update to version v4.2.2

moodle/moodle (PHP):

Affected version(s) >=v3.10.0-beta <v3.10.6

Fix Suggestion:

Update to version v3.10.6

Related Resources (2)

https://github.com/moodle/moodle/commit/b0d1cef0e0ed5987bf8d46d24ac1c12f044c5032

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2023-40325

Do you need more information?

CVSS v4

Base Score:

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

NONE

Vulnerable System Confidentiality

NONE

Vulnerable System Integrity

LOW

Vulnerable System Availability

NONE

Subsequent System Confidentiality

NONE

Subsequent System Integrity

NONE

Subsequent System Availability

NONE

CVSS v3

Base Score:

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE