CVE-2025-3645: Moodle Messaging Web Service IDOR Vulnerability
Summary
CVE-2025-3645: Moodle has an IDOR in messaging web service which allows access to some user details. Affects moodle/moodle across 4 version ranges.
< 4.1.18
>= 4.3.0-beta, < 4.3.12
>= 4.4.0-beta, < 4.4.8
>= 4.5.0-beta, < 4.5.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is a widely used open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It offers various features such as course management, user management, and messaging services. However, Moodle has been found to have a vulnerability in its messaging web service that allows users to access details of other users without proper authorization.
Vulnerability Detail
A flaw was discovered in Moodle's messaging web service due to insufficient capability checks. This vulnerability allows users to view sensitive information such as other users' names and online statuses, potentially leading to privacy breaches and unauthorized access to user data. The vulnerability is classified as an Insecure Direct Object Reference (IDOR), which is a common issue where an application does not properly validate user permissions before granting access to resources.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.184.1.18composer require moodle/moodle:4.1.18 -
>= 4.3.0-beta, < 4.3.124.3.12composer require moodle/moodle:4.3.12 -
>= 4.4.0-beta, < 4.4.84.4.8composer require moodle/moodle:4.4.8 -
>= 4.5.0-beta, < 4.5.44.5.4composer require moodle/moodle:4.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the messaging web service until the package is updated. This can be done by modifying the service settings in the Moodle administration panel to limit user interactions.
Conclusion
In summary, the IDOR vulnerability in Moodle's messaging web service poses a risk to user privacy and data security. It is crucial for users to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for moodle/moodle →
FAQ
The vulnerability is an Insecure Direct Object Reference (IDOR) in Moodle's messaging web service, allowing unauthorized access to user details.
You can check if your application is affected by using Vulert's playground at Vulert Scanner, which analyzes your composer.lock file for vulnerabilities.
The risks include unauthorized access to user information, potential privacy violations, and the possibility of further exploitation of user data.
Yes, you can restrict access to the messaging web service temporarily until the patch is applied.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
