CVE-2025-3643: Moodle Reflected XSS Vulnerability in Policy Tool
Summary
CVE-2025-3643: Moodle has reflected Cross-site Scripting risk in policy tool. Affects moodle/moodle across 4 version ranges.
< 4.1.18
>= 4.3.0-beta, < 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2025-3643 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is a widely-used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers features such as course management, user enrollment, and assessment tools. However, a recently identified vulnerability poses a risk to user security within the policy tool, which is integral for managing user agreements and compliance.
Vulnerability Detail
A flaw was discovered in Moodle's policy tool where the return URL was not adequately sanitized. This oversight allows for reflected Cross-site Scripting (XSS) attacks, where an attacker can inject malicious scripts into web pages viewed by users. The implications of this vulnerability are significant, as it could lead to unauthorized actions being performed on behalf of users, data theft, or session hijacking.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.184.1.18composer require moodle/moodle:4.1.18 -
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can implement input validation and sanitization on the return URL parameter in the policy tool to mitigate the risk of XSS attacks until the package is updated.
Conclusion
The reflected XSS vulnerability in Moodle's policy tool poses a significant risk to user security. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability is a reflected Cross-site Scripting (XSS) risk due to insufficient sanitization of the return URL in Moodle's policy tool.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the context of a user's session, potentially leading to data theft or unauthorized actions.
Affected versions include those prior to 4.1.18, 4.3.12, 4.4.8, and 4.5.4. Ensure your installation is updated to one of these patched versions.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.4, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
