GHSA-cpm7-mv33-jwf8
Moodle's AJAX section delete does not respect course_can_delete_section()
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | < 4.1.18 | 4.1.18 |
| Packagist | moodle/moodle | >= 4.3.0-beta, < 4.3.12 | 4.3.12 |
| Packagist | moodle/moodle | >= 4.4.0-beta, < 4.4.8 | 4.4.8 |
| Packagist | moodle/moodle | >= 4.5.0-beta, < 4.5.4 | 4.5.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-3644
- https://access.redhat.com/security/cve/CVE-2025-3644
- https://bugzilla.redhat.com/show_bug.cgi?id=2359745
- https://github.com/moodle/moodle
- https://github.com/search?q=repo%3Amoodle%2Fmoodle+MDL-83994&type=commits
- https://moodle.org/mod/forum/discuss.php?d=467605