CVE-2025-3638: Moodle: csrf risk in brickfield tool's analysis request action
A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk.
Other sources
The analysis request action in the Brickfield tool did not include the necessary token to prevent a CSRF risk.
Versions affected: 4.5 to 4.5.3, 4.4 to 4.4.7, 4.3 to 4.3.11, 4.1 to 4.1.17 and earlier unsupported versions.
Versions fixed: 4.5.4, 4.4.8, 4.3.12 and 4.1.18
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3638?
CVE-2025-3638 is classified as a high severity vulnerability due to its potential for exploiting CSRF risks in Moodle.
How do I fix CVE-2025-3638?
To fix CVE-2025-3638, upgrade to Moodle version 4.5.4, 4.4.8, 4.3.12, or 4.1.18 or later.
What is the nature of CVE-2025-3638?
CVE-2025-3638 is a Cross-site request forgery (CSRF) vulnerability related to the analysis request action in the Brickfield tool of Moodle.
Which versions of Moodle are affected by CVE-2025-3638?
Moodle versions 4.5, 4.4, 4.3, and 4.1 up to their respective latest patch versions prior to the fixed versions are affected by CVE-2025-3638.
Is CVE-2025-3638 easily exploited?
Yes, CVE-2025-3638 can be exploited easily due to the lack of necessary tokens in the analysis request action, posing a significant risk to users.