CVE-2025-3637: Moodle mod_data CSRF Token Exposure Vulnerability
Summary
CVE-2025-3637: Moodle's mod_data edit/delete pages pass CSRF token in GET parameter. Affects moodle/moodle across 4 version ranges.
>= 4.3.0-beta, < 4.3.12
< 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4.3.12, 4.4.8 or 4.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. The mod_data module in Moodle allows users to create and manage data collections, facilitating the organization and sharing of information. However, a recent vulnerability has been identified that compromises the security of this module, specifically concerning the handling of CSRF tokens.
Vulnerability Detail
A security vulnerability was discovered in Moodle's mod_data module, where the edit and delete pages expose the CSRF token through the URL. This flaw allows potential attackers to exploit the token, leading to unauthorized actions being performed on behalf of legitimate users. The vulnerability arises from the improper handling of sensitive information, which should not be publicly accessible. The ramifications include the risk of unauthorized data manipulation and potential data breaches, making it critical for users to address this issue promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
< 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict access to the mod_data edit and delete pages until the update is applied. This can be done by modifying user permissions or disabling the mod_data module until the patch is installed.
Conclusion
The CSRF token exposure vulnerability in Moodle's mod_data module poses a significant risk to users by allowing unauthorized actions through exposed tokens. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability involves the exposure of CSRF tokens in the URL of Moodle's mod_data edit and delete pages, which can be exploited by attackers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized actions being performed on behalf of legitimate users, which can lead to data manipulation and breaches.
Yes, patches are available in versions 4.3.12, 4.4.8, and 4.5.4 of Moodle.
The CVSS score for this vulnerability is 3.1, indicating a low severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
