SB2025042221 - Multiple vulnerabilities in Moodle

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2025042221

SB2025042221 - Multiple vulnerabilities in Moodle

Published: April 22, 2025

Security Bulletin ID SB2025042221
Severity
High
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 69% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 secuirty vulnerabilities.


1) Cross-site request forgery (CVE-ID: CVE-2025-3635)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin when the user tours duplicate tour action. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


2) Improper access control (CVE-ID: CVE-2025-3625)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the IDOR issue in the Multi-Factor Authentication email factor's revoke/cancel action. A remote user can perform a denial of service (DoS) attack and disclose the impacted user's name.


3) Code Injection (CVE-ID: CVE-2024-40446)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in an undocumented MimeTeX command. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


4) Improper Authentication (CVE-ID: CVE-2025-3627)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests with Multi-Factor Authentication enabled. A remote user can gain access to some of the user data after passing only the first login factor.


5) Improper access control (CVE-ID: CVE-2025-3647)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the IDOR issue when accessing the cohorts report. A remote user can fetch cohort data they are not have access to.


6) Improper access control (CVE-ID: CVE-2025-3645)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the IDOR issue in messaging web service. A remote user can view other users' names and online status.


7) Improper access control (CVE-ID: CVE-2025-3644)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the AJAX section delete does not respect course_can_delete_section(). A remote user can delete course sections they do not have permission to modify.


8) Cross-site scripting (CVE-ID: CVE-2025-3643)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in policy tool. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


9) Code Injection (CVE-ID: CVE-2025-3642)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Moodle LMS EQUELLA repository. A remote user can execute arbitrary code on the target system.


10) Code Injection (CVE-ID: CVE-2025-3641)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in the Moodle LMS Dropbox repository. A remote user can execute arbitrary code on the target system.


11) Improper access control (CVE-ID: CVE-2025-3640)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the IDOR issue in web service. A remote user enrolled in a course can access some details of other users.


12) Cross-site request forgery (CVE-ID: CVE-2025-3638)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in Brickfield tool's analysis request action. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


13) Cross-site request forgery (CVE-ID: CVE-2025-3637)

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the database module's edit and delete pages within the GET parameter. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.


14) Improper access control (CVE-ID: CVE-2025-3636)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to the IDOR issue in RSS block. A remote user can view RSS feed content without permission to access.


15) Information disclosure (CVE-ID: CVE-2025-3628)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to assignment submissions search on anonymous submissions reveals student identities. A remote user can gain unauthorized access to sensitive information on the system.


16) Improper Authentication (CVE-ID: CVE-2025-3634)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests with MFA enabled. A remote user can gain access to self enrolment without passing a second login factor.


Remediation

Install update from vendor's website.

References