CVE-2025-2201: IcProgress Plugin Access Control Flaw

CVE-2025-2201 Overview

CVE-2025-2201 is a broken access control vulnerability affecting the IcProgress plugin developed by Innovación y Cualificación for the Moodle learning platform. The flaw allows an unauthenticated remote attacker to retrieve sensitive information belonging to other users, including public IP addresses and private messages exchanged between users. The weakness is classified under [CWE-863: Incorrect Authorization]. Because the plugin fails to properly verify user context when serving data, an attacker only needs network access to the affected Moodle instance to exploit it. The vulnerability was published to the National Vulnerability Database on 2025-03-17 and coordinated through the Spanish National Cybersecurity Institute (INCIBE).

Critical Impact
Unauthenticated network-based access to sensitive user data, including IP addresses and private messages of other users on affected Moodle deployments.

Affected Products

Moodle IcProgress plugin by Innovación y Cualificación
Moodle deployments using the vulnerable IcProgress plugin version
Learning environments hosted on Moodle with the plugin enabled

Discovery Timeline

2025-03-17 - CVE-2025-2201 published to NVD and disclosed via INCIBE-CERT security notice
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2201

Vulnerability Analysis

The IcProgress plugin exposes endpoints that return user-specific data without validating whether the requesting user has authorization to view that data. An attacker can iterate over user identifiers or resource references and receive information tied to arbitrary accounts. Disclosed data includes public IP addresses associated with users and message content exchanged between them.

Broken access control flaws of this type stem from missing server-side authorization checks. The application relies on client-side context or predictable identifiers rather than enforcing that the authenticated principal owns or is entitled to access the requested resource. In this case, the plugin returns records regardless of the caller identity.

The impact is limited to confidentiality. Attackers cannot modify data or disrupt service through this specific weakness, but the exposed information supports follow-on attacks such as targeted phishing, correlation of student activity, or account takeover attempts.

Root Cause

The root cause is an incorrect authorization implementation [CWE-863]. The plugin does not verify that the caller has permission to access the requested user records before returning them in the HTTP response. Session context or role checks that should gate the data-retrieval logic are missing or ineffective.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker sends crafted HTTP requests to the vulnerable plugin endpoints on a Moodle instance running IcProgress. The server returns data belonging to other users, which the attacker collects for further use.

No public proof-of-concept or exploit code is currently available. Refer to the INCIBE Security Notice for coordinated advisory details.

Detection Methods for CVE-2025-2201

Indicators of Compromise

Unusual volumes of HTTP requests targeting IcProgress plugin endpoints from a single source address
Sequential enumeration patterns in web server access logs against user- or message-related plugin URLs
Requests to plugin endpoints originating from unauthenticated sessions or unexpected geographies

Detection Strategies

Review Moodle and web server access logs for repeated requests to IcProgress plugin paths that return user data
Correlate authentication logs with plugin data-access events to identify unauthenticated retrieval of user records
Baseline normal plugin usage patterns and alert on volumetric or sequential deviations consistent with scraping

Monitoring Recommendations

Enable verbose logging on the Moodle application and forward logs to a centralized analytics platform for retention and correlation
Monitor for outbound data volumes from the Moodle host that exceed established baselines
Track new user agents and IP ranges accessing plugin endpoints and alert on anomalies

How to Mitigate CVE-2025-2201

Immediate Actions Required

Inventory Moodle deployments and identify installations of the IcProgress plugin from Innovación y Cualificación
Restrict network access to the Moodle instance to trusted networks until a fix is applied
Disable the IcProgress plugin if it is not required for current operations
Review recent access logs for evidence of exploitation and notify affected users if disclosure is confirmed

Patch Information

Consult the INCIBE Security Notice for vendor guidance and available updates. Apply any plugin release from Innovación y Cualificación that addresses the incorrect authorization issue and verify the fix in a staging environment before production rollout.

Workarounds

Disable the IcProgress plugin in the Moodle administration console until a patched version is deployed
Place the Moodle instance behind a web application firewall (WAF) and block anonymous requests to plugin endpoints that return user data
Enforce authentication on all plugin routes at the reverse proxy layer where feasible
Rotate session tokens and audit user accounts after remediation to detect any prior misuse

bash

# Example: block unauthenticated access to IcProgress endpoints at an NGINX reverse proxy
location ~* /mod/icprogress/ {
    # Require an authenticated Moodle session cookie
    if ($cookie_MoodleSession = "") {
        return 403;
    }
    proxy_pass http://moodle_backend;
}