CVE-2025-2202 Details
Description
Broken access control vulnerability in the Innovación y Cualificación local administration plugin ajax.php. This vulnerability allows an attacker to obtain sensitive information about other users such as id, name, login and email.
A broken access control vulnerability has been identified in the Innovación y Cualificación local administration plugin, specifically in the ajax.php file. This vulnerability allows attackers to access sensitive information about other users, including their ID, name, login, and email address.
A new version has been released to address these vulnerabilities, and the update has been implemented in all affected installations. The process will be completed by December 2024.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 17, 2025CISA-ADP
Assessed Mar 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-moodle-innovacion-y-cualificacion-plugins | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Innovación y Cualificación local administración ajax.php | All versions |
CPE
Remediation
| |
| Innovación y Cualificación IcProgreso | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 17, 2025 | New CVE Received | [email protected] |