CVE-2025-60511: Medium severity Moodle OpenAI Chat Block plugin vulnerability
Moodle OpenAI Chat Block plugin 3.0.1 (2025021700) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to insufficient validation of the blockId parameter in /blocks/openaichat/api/completion.php. An authenticated student can impersonate another user's block (e.g., administrator) and send queries that are executed with that block's configuration. This can expose administrator-only Source of Truth entries, alter model behavior, and potentially misuse API resources.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Moodle OpenAI Chat Block pluginto a version that resolves this vulnerability.Fixed in 3.0.1 (2025021700) - Configuration
Update the plugin so the blockId parameter is validated and tied to the authenticated user/session authorization; reject any blockId that the user is not permitted to access.
Moodle OpenAI Chat Block plugin (/blocks/openai_chat/api/completion.php) blockId parameter validation = enforce strict authorization checks to ensure the authenticated user is allowed to use the specified blockId before executing completion using that block’s configuration - Compensating control
Restrict access to the Moodle endpoint /blocks/openai_chat/api/completion.php (e.g., via network controls/ACL/WAF) so authenticated users cannot call it to impersonate other users’ block configurations.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60511?
CVE-2025-60511 is classified as a high-severity vulnerability due to the potential for unauthorized access to another user's data.
How do I fix CVE-2025-60511?
To address CVE-2025-60511, update the Moodle OpenAI Chat Block plugin to the latest version that includes a fix for the insecure direct object reference (IDOR) issue.
Who is affected by CVE-2025-60511?
CVE-2025-60511 affects users of the Moodle OpenAI Chat Block plugin version 3.0.1 and earlier who have authenticated access.
What kind of attacks can exploit CVE-2025-60511?
CVE-2025-60511 can be exploited to impersonate other users, allowing an authenticated student to access or manipulate another user's block.
Is CVE-2025-60511 a known issue in previous versions?
Yes, CVE-2025-60511 is a known issue that exists in Moodle OpenAI Chat Block plugin versions prior to the patch release addressing the IDOR vulnerability.