Nixpkgs security tracker

Untriaged

Permalink CVE-2025-3637

3.1 LOW

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): HIGH
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): LOW
Integrity impact (I): NONE
Availability impact (A): NONE

created 6 months, 3 weeks ago

Moodle: csrf token exposure via url in moodle mod_data module

A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356
https://access.redhat.com/security/cve/CVE-2025-3637 x_refsource_REDHATvdb-entry
RHBZ#2359727 issue-trackingx_refsource_REDHAT

Affected products

moodle

<4.4.8
<4.3.12
<4.5.4
<4.1.18

Matching in nixpkgs

pkgs.moodle

Free and open-source learning management system (LMS) written in PHP

nixos-unstable -
- nixpkgs-unstable 5.0.2

pkgs.moodle-dl

Moodle downloader that downloads course content fast from Moodle

nixos-unstable -
- nixpkgs-unstable 2.3.13

Package maintainers