CVE-2025-3637

Moodle: csrf token exposure via url in moodle mod_data module

State: Published
Severity: 3.1 Low
Published: Apr 25, 2025
Updated: Apr 25, 2025
Reserved: Apr 15, 2025

Description

A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	fedora

Weaknesses

CWE-598 Use of GET Request Method With Sensitive Query Strings

Affected Products

Product	Versions
moodle	4.5.0 to before 4.5.4Affected 4.4.0 to before 4.4.8Affected 4.3.0 to before 4.3.12Affected 4.1.0 to before 4.1.18Affected

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356
https://access.redhat.com/security/cve/CVE-2025-3637vdb-entry
RHBZ#2359727issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.