A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the sites URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.
Weakness
The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Moodle | Moodle | * | 4.3.12 (excluding) |
| Moodle | Moodle | 4.4.0 (including) | 4.4.8 (excluding) |
| Moodle | Moodle | 4.5.0 (including) | 4.5.4 (excluding) |
Potential Mitigations
References
- http://git.moodle.org/gw?p=moodle.git\u0026a=search\u0026h=HEAD\u0026st=commit\u0026s=MDL-65356
- https://access.redhat.com/security/cve/CVE-2025-3637
- https://bugzilla.redhat.com/show_bug.cgi?id=2359727