GHSA-qhc7-xhc2-7p7w
First published: Fri Apr 25 2025(Updated: )
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | >=4.5.0-beta<4.5.4 | 4.5.4 |
| composer/moodle/moodle | >=4.4.0-beta<4.4.8 | 4.4.8 |
| composer/moodle/moodle | >=4.3.0-beta<4.3.12 | 4.3.12 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2025-3634
- https://access.redhat.com/security/cve/CVE-2025-3634
- https://bugzilla.redhat.com/show_bug.cgi?id=2359707
- https://github.com/moodle/moodle/commit/b0965139014b459c3cb96e4fff45af4d5e09e261
- https://moodle.org/mod/forum/discuss.php?d=467596
- https://github.com/advisories/GHSA-qhc7-xhc2-7p7w (Advisory)
Frequently Asked Questions
What is the severity of GHSA-qhc7-xhc2-7p7w?
The severity of GHSA-qhc7-xhc2-7p7w is considered medium due to the risk of unauthorized course enrollments.
How do I fix GHSA-qhc7-xhc2-7p7w?
To fix GHSA-qhc7-xhc2-7p7w, update Moodle to version 4.5.4, 4.4.8, or 4.3.12.
What vulnerabilities does GHSA-qhc7-xhc2-7p7w expose?
GHSA-qhc7-xhc2-7p7w exposes the risk of students enrolling in courses without completing safety checks.
Which versions of Moodle are affected by GHSA-qhc7-xhc2-7p7w?
Moodle versions 4.5.0 to 4.5.4, 4.4.0 to 4.4.8, and 4.3.0 to 4.3.12 are affected by GHSA-qhc7-xhc2-7p7w.
What impact does GHSA-qhc7-xhc2-7p7w have on users?
GHSA-qhc7-xhc2-7p7w allows users to bypass two-step verification, leading to potential unauthorized access to course materials.
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-qhc7-xhc2-7p7w
- alias/CVE-2025-3634
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/references
- agent/source
- agent/softwarecombine
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/tags
- agent/description
- agent/event
- package-manager/composer