CVE-2025-3628: Moodle Anonymous Submission De-anonymization Vulnerability
Summary
CVE-2025-3628: Moodle reveals student identities through assignment submissions search on anonymous submissions. Affects moodle/moodle versions >= 4.5.0-beta, < 4.5.4. Fixed in 4.5.4. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-3628 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is a widely-used open-source learning management system (LMS) designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It supports various features such as course management, assignment submissions, and grading. However, a vulnerability has been identified in Moodle that affects the anonymity of student submissions in assignments, potentially compromising student privacy.
Vulnerability Detail
A flaw was discovered in Moodle where anonymous assignment submissions can be de-anonymized through search functionalities. This vulnerability allows unauthorized individuals to reveal the identities of students who submitted assignments anonymously, posing significant risks to student privacy and confidentiality. The issue arises from improper handling of search queries that can link submissions back to student identities, making it a critical concern for educational institutions relying on Moodle for anonymous assessments.
How To Fix
Minimum fixed version
4.5.4
This is the first release that contains the fix.
composer require moodle/moodle:4.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the anonymous submission feature for assignments until the update can be applied. This can be done by navigating to the assignment settings and unchecking the 'Allow anonymous submissions' option.
Conclusion
The CVE-2025-3628 vulnerability in Moodle poses a significant risk to student privacy by allowing the de-anonymization of anonymous assignment submissions. It is crucial for users to update to version 4.5.4 or later to mitigate this risk. Additionally, temporary workarounds can be employed until the update is applied.
See every vulnerability recorded for moodle/moodle →
FAQ
CVE-2025-3628 is a vulnerability in Moodle that allows for the de-anonymization of student identities through anonymous assignment submissions.
This vulnerability can compromise student privacy by revealing their identities when they submit assignments anonymously, which can lead to potential harassment or bias.
The affected versions are Moodle 4.5.0-beta up to 4.5.3. The vulnerability is fixed in version 4.5.4.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software, using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
