CVE-2025-3637: Moodle: csrf token exposure via url in moodle mod_data module
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the moddata module: edit and delete pages.
Other sources
A user's CSRF token was unnecessarily included in the URL on the database module's edit and delete pages.
Versions affected: 4.5 to 4.5.3, 4.4 to 4.4.7, 4.3 to 4.3.11, 4.1 to 4.1.17 and earlier supported versions.
Versions fixed: 4.5.4, 4.4.8, 4.3.12 and 4.1.18
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3637?
CVE-2025-3637 has been classified with a medium severity level due to the potential exposure of confidential information.
How do I fix CVE-2025-3637?
To fix CVE-2025-3637, update Moodle to the latest version that addresses the vulnerability.
Which versions of Moodle are affected by CVE-2025-3637?
CVE-2025-3637 affects Moodle versions 4.1 through 4.5.3, including specified versions in between.
What kind of information is disclosed due to CVE-2025-3637?
CVE-2025-3637 discloses confidential information via the site's URL, compromising the site's defenses against CSRF attacks.
Is it safe to use Moodle versions that are susceptible to CVE-2025-3637?
Using affected versions of Moodle is not safe, as it increases the risk of potential CSRF attacks leading to unauthorized actions.