CVE-2025-3634: Moodle: moodle allows course self-enrolment before completing mfa
First published: Tue Apr 15 2025(Updated: )
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.
Credit: patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Moodle | >=4.5<=4.5.3>=4.4<=4.4.7>=4.3<=4.3.11 | |
| composer/moodle/moodle | >=4.5.0-beta<4.5.4 | 4.5.4 |
| composer/moodle/moodle | >=4.4.0-beta<4.4.8 | 4.4.8 |
| composer/moodle/moodle | >=4.3.0-beta<4.3.12 | 4.3.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2025-3634
- https://bugzilla.redhat.com/show_bug.cgi?id=2359707
- https://nvd.nist.gov/vuln/detail/CVE-2025-3634
- https://github.com/moodle/moodle/commit/b0965139014b459c3cb96e4fff45af4d5e09e261
- https://moodle.org/mod/forum/discuss.php?d=467596
- https://github.com/advisories/GHSA-qhc7-xhc2-7p7w (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-3634?
CVE-2025-3634 is categorized as a high-severity vulnerability due to its potential to allow unauthorized course enrollments.
How do I fix CVE-2025-3634?
To remediate CVE-2025-3634, upgrade to Moodle version 4.5.4, 4.4.8, or 4.3.12 depending on your current version.
Which versions of Moodle are affected by CVE-2025-3634?
CVE-2025-3634 affects Moodle versions 4.5.0 to 4.5.3, 4.4.0 to 4.4.7, and 4.3.0 to 4.3.11.
What can happen if CVE-2025-3634 is exploited?
If exploited, CVE-2025-3634 allows students to enroll in courses without completing required verification processes, potentially compromising course integrity.
Is there a patch available for CVE-2025-3634?
Yes, a patch is available in the form of updated versions: 4.5.4, 4.4.8, and 4.3.12 for Moodle.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-3634
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-qhc7-xhc2-7p7w
- agent/references
- agent/softwarecombine
- agent/event
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/nvd-cve
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/github-advisory
- vendor/moodle
- canonical/moodle
- package-manager/composer