CVE-2025-3637

Description

A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

Reserved 2025-04-15 | Published 2025-04-25 | Updated 2025-04-25 | Assigner fedora

Problem types

Use of GET Request Method With Sensitive Query Strings

Product status

Default status
unaffected

4.5.0 before 4.5.4
affected

4.4.0 before 4.4.8
affected

4.3.0 before 4.3.12
affected

4.1.0 before 4.1.18
affected

Timeline

2025-04-15:	Reported to Red Hat.
2025-04-22:	Made public.

Credits

Red Hat would like to thank Simon Reinhart for reporting this issue.

References

git.moodle.org/....git&a=search&h=HEAD&st=commit&s=MDL-65356

access.redhat.com/security/cve/CVE-2025-3637 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2359727 (RHBZ#2359727) issue-tracking

cve.org (CVE-2025-3637)

nvd.nist.gov (CVE-2025-3637)

Download JSON