CVE-2025-3637

Published: Apr 25, 2025Modified: Jun 17, 2026

3.1

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 1.6 / Impact: 1.4

Source: patrick@puiterwijk.org (Secondary)

Description

A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

Affected (3)

Products: Moodle: Moodle

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Before 4.3.12
Moodle Moodle	From 4.4.0 to 4.4.8
Moodle Moodle	From 4.5.0 to 4.5.4

Related CWEs

Use of GET Request Method With Sensitive Query Strings

The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

References (3)

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356

Source: patrick@puiterwijk.org

Patch

https://access.redhat.com/security/cve/CVE-2025-3637

Source: patrick@puiterwijk.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2359727

Source: patrick@puiterwijk.org

Issue Tracking

Timeline

No history available yet.