SB2025042221 - Multiple vulnerabilities in Moodle
Published: April 22, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Cross-site request forgery (CVE-ID: CVE-2025-3635)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin when the user tours duplicate tour action. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
2) Improper access control (CVE-ID: CVE-2025-3625)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the IDOR issue in the Multi-Factor Authentication email factor's revoke/cancel action. A remote user can perform a denial of service (DoS) attack and disclose the impacted user's name.
3) Code Injection (CVE-ID: CVE-2024-40446)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in an undocumented MimeTeX command. A remote attacker can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Improper Authentication (CVE-ID: CVE-2025-3627)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests with Multi-Factor Authentication enabled. A remote user can gain access to some of the user data after passing only the first login factor.
5) Improper access control (CVE-ID: CVE-2025-3647)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the IDOR issue when accessing the cohorts report. A remote user can fetch cohort data they are not have access to.
6) Improper access control (CVE-ID: CVE-2025-3645)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the IDOR issue in messaging web service. A remote user can view other users' names and online status.
7) Improper access control (CVE-ID: CVE-2025-3644)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the AJAX section delete does not respect course_can_delete_section(). A remote user can delete course sections they do not have permission to modify.
8) Cross-site scripting (CVE-ID: CVE-2025-3643)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in policy tool. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
9) Code Injection (CVE-ID: CVE-2025-3642)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the Moodle LMS EQUELLA repository. A remote user can execute arbitrary code on the target system.
10) Code Injection (CVE-ID: CVE-2025-3641)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation in the Moodle LMS Dropbox repository. A remote user can execute arbitrary code on the target system.
11) Improper access control (CVE-ID: CVE-2025-3640)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the IDOR issue in web service. A remote user enrolled in a course can access some details of other users.
12) Cross-site request forgery (CVE-ID: CVE-2025-3638)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in Brickfield tool's analysis request action. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
13) Cross-site request forgery (CVE-ID: CVE-2025-3637)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin in the database module's edit and delete pages within the GET parameter. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
14) Improper access control (CVE-ID: CVE-2025-3636)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to the IDOR issue in RSS block. A remote user can view RSS feed content without permission to access.
15) Information disclosure (CVE-ID: CVE-2025-3628)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to assignment submissions search on anonymous submissions reveals student identities. A remote user can gain unauthorized access to sensitive information on the system.
16) Improper Authentication (CVE-ID: CVE-2025-3634)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests with MFA enabled. A remote user can gain access to self enrolment without passing a second login factor.
Remediation
Install update from vendor's website.
References
- https://moodle.org/mod/forum/discuss.php?d=467597
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84479&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467593
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-85015&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467592
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-85152&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467594
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84351&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467607
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84865&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467606
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-72704&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467605
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-83994&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467604
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-85104&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467603
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84473&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467602
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84475&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467601
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84750&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467600
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84478&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467599
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-65356&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467598
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84499&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467595
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84447&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467596
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-84784&type=commits