CVE-2025-3637: Moodle's mod_data edit/delete pages pass CSRF token in GET parameter
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the moddata module: edit and delete pages.
Other sources
A user's CSRF token was unnecessarily included in the URL on the database module's edit and delete pages.
Versions affected: 4.5 to 4.5.3, 4.4 to 4.4.7, 4.3 to 4.3.11, 4.1 to 4.1.17 and earlier supported versions.
Versions fixed: 4.5.4, 4.4.8, 4.3.12 and 4.1.18
— Red Hat
Moodle's moddata edit/delete pages pass CSRF token in GET parameter
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.5.4 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.12 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.18 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.5.4 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.4.8 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.3.12 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.1.18
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3637?
CVE-2025-3637 has been classified with a medium severity level due to the potential exposure of confidential information.
How do I fix CVE-2025-3637?
To fix CVE-2025-3637, update Moodle to the latest version that addresses the vulnerability.
Which versions of Moodle are affected by CVE-2025-3637?
CVE-2025-3637 affects Moodle versions 4.1 through 4.5.3, including specified versions in between.
What kind of information is disclosed due to CVE-2025-3637?
CVE-2025-3637 discloses confidential information via the site's URL, compromising the site's defenses against CSRF attacks.
Is it safe to use Moodle versions that are susceptible to CVE-2025-3637?
Using affected versions of Moodle is not safe, as it increases the risk of potential CSRF attacks leading to unauthorized actions.