~ / search / GHSA-9vc3-vm42-fjhm

GHSA-9vc3-vm42-fjhm

Moodle's mod_data edit/delete pages pass CSRF token in GET parameter

Source: GitHub Advisory Database (reviewed) Low CVE-2025-3637

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle < 4.3.12 4.3.12
Packagist moodle/moodle >= 4.3.0-beta, < 4.3.12 4.3.12
Packagist moodle/moodle >= 4.4.0-beta, < 4.4.8 4.4.8
Packagist moodle/moodle >= 4.5.0-beta, < 4.5.4 4.5.4

Details

As written in the advisory (Markdown source, shown as plain text).

A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

References

External links from the advisory. They lead to third-party sites.