Home

Description

A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk.

PUBLISHED Reserved 2025-04-15 | Published 2025-04-25 | Updated 2025-04-28 | Assigner fedora

Problem types

Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

4.5.0 (semver) before 4.5.4
affected

4.4.0 (semver) before 4.4.8
affected

4.3.0 (semver) before 4.3.12
affected

4.1.0 (semver) before 4.1.18
affected

Timeline

2025-04-15:Reported to Red Hat.
2025-04-22:Made public.

Credits

Red Hat would like to thank Vincent Schneider for reporting this issue.

References

access.redhat.com/security/cve/CVE-2025-3638 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2359732 (RHBZ#2359732) issue-tracking

moodle.org/mod/forum/discuss.php?d=467600

cve.org (CVE-2025-3638)

nvd.nist.gov (CVE-2025-3638)

Download JSON