GHSA-chmf-m33p-ph8m
Moodle allows IDOR in RSS block, which allows access to additional RSS feeds
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | < 4.1.18 | 4.1.18 |
| Packagist | moodle/moodle | >= 4.3.0-beta, < 4.3.12 | 4.3.12 |
| Packagist | moodle/moodle | >= 4.4.0-beta, < 4.4.8 | 4.4.8 |
| Packagist | moodle/moodle | >= 4.5.0-beta, < 4.5.4 | 4.5.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-3636
- https://github.com/moodle/moodle/commit/0bd97209ac5e217dbec236c73e4f6fdcaee1c737
- https://access.redhat.com/security/cve/CVE-2025-3636
- https://bugzilla.redhat.com/show_bug.cgi?id=2359726
- https://github.com/moodle/moodle
- https://moodle.org/mod/forum/discuss.php?d=467598
- http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-84499