CVE-2025-3635: Moodle: csrf risk in moodle user tours manager allows tour duplication
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks.
Other sources
The user tours duplicate tour action did not include the necessary token to prevent a CSRF risk.
Versions affected: 4.5 to 4.5.3, 4.4 to 4.4.7, 4.3 to 4.3.11, 4.1 to 4.1.17 and earlier unsupported versions Versions fixed: 4.5.4, 4.4.8, 4.3.12 and 4.1.18
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3635?
CVE-2025-3635 is considered a high severity vulnerability due to its potential for unauthorized access and actions.
How do I fix CVE-2025-3635?
To fix CVE-2025-3635, upgrade Moodle to version 4.5.4, 4.4.8, 4.3.12, or 4.1.18 depending on your current version.
What types of attacks are possible with CVE-2025-3635?
CVE-2025-3635 is susceptible to cross-site request forgery (CSRF) attacks, allowing users to duplicate tours without authentication.
Which versions of Moodle are affected by CVE-2025-3635?
Moodle versions from 4.1 to 4.5.3 are affected by CVE-2025-3635.
Who can exploit CVE-2025-3635?
CVE-2025-3635 can be exploited by anyone, as it does not require user authentication to perform actions.