CVE-2025-3638: Moodle Brickfield Tool CSRF Vulnerability
Summary
CVE-2025-3638: Moodle has a CSRF risk in Brickfield tool's analysis request action. Affects moodle/moodle across 4 version ranges.
< 4.1.18
>= 4.3.0-beta, < 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-3638 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. The Brickfield tool within Moodle is used for analyzing and optimizing course content. However, it has been identified to have a critical security flaw that exposes it to Cross-site Request Forgery (CSRF) attacks, potentially compromising user data and system integrity.
Vulnerability Detail
A flaw was found in Moodle's Brickfield tool where the analysis request action did not include the necessary CSRF token. This oversight allows attackers to forge requests on behalf of authenticated users, leading to unauthorized actions being executed without the user's consent. The vulnerability is classified under CWE-352, indicating a weakness in the application's ability to validate requests, which could result in data manipulation or exposure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.184.1.18composer require moodle/moodle:4.1.18 -
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can limit access to the Brickfield tool until the patch is applied. Additionally, implementing strict Content Security Policy (CSP) headers may help mitigate the risk of CSRF attacks.
Conclusion
The CSRF vulnerability identified in Moodle's Brickfield tool poses a significant risk to users and their data. It is crucial to apply the necessary updates to mitigate this risk. By staying informed and proactive, users can protect their Moodle installations from potential threats.
See every vulnerability recorded for moodle/moodle →
FAQ
Cross-site Request Forgery (CSRF) is a type of attack that tricks the victim into submitting a malicious request, allowing attackers to perform actions on behalf of the user without their consent.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to perform unauthorized actions within the Moodle platform, potentially leading to data breaches or loss of integrity.
Yes, not updating Moodle exposes your installation to potential exploitation, which could compromise user data and the overall security of your system.
If immediate updates are not possible, consider restricting access to the affected features and monitoring for any suspicious activity until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
