Search for vulnerabilities
Vulnerability details: VCID-ma3y-9qsu-gqd2
Vulnerability ID VCID-ma3y-9qsu-gqd2
Aliases CVE-2025-3635
GHSA-88xj-97gf-7wpq
Summary Moodle has a CSRF risk in user tours manager that allows tour duplication A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks.
Status Published
Exploitability 0.5
Weighted Severity 3.1
Risk 1.6
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-352 Cross-Site Request Forgery (CSRF)
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 3.5 https://access.redhat.com/security/cve/CVE-2025-3635
generic_textual LOW https://access.redhat.com/security/cve/CVE-2025-3635
ssvc Track https://access.redhat.com/security/cve/CVE-2025-3635
epss 0.00016 https://api.first.org/data/v1/epss?cve=CVE-2025-3635
epss 0.00018 https://api.first.org/data/v1/epss?cve=CVE-2025-3635
cvssv3.1 3.5 https://bugzilla.redhat.com/show_bug.cgi?id=2359709
generic_textual LOW https://bugzilla.redhat.com/show_bug.cgi?id=2359709
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2359709
cvssv3.1 3.5 https://github.com/moodle/moodle
generic_textual LOW https://github.com/moodle/moodle
cvssv3.1 3.5 https://github.com/moodle/moodle/commit/dbd723f81c07423d4082d54cd1d90b1b68c44379
generic_textual LOW https://github.com/moodle/moodle/commit/dbd723f81c07423d4082d54cd1d90b1b68c44379
cvssv3.1 3.5 https://moodle.org/mod/forum/discuss.php?d=467597
generic_textual LOW https://moodle.org/mod/forum/discuss.php?d=467597
cvssv3.1 3.5 https://nvd.nist.gov/vuln/detail/CVE-2025-3635
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-3635
Reference id Reference type URL
https://access.redhat.com/security/cve/CVE-2025-3635
https://api.first.org/data/v1/epss?cve=CVE-2025-3635
https://bugzilla.redhat.com/show_bug.cgi?id=2359709
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/dbd723f81c07423d4082d54cd1d90b1b68c44379
https://moodle.org/mod/forum/discuss.php?d=467597
https://nvd.nist.gov/vuln/detail/CVE-2025-3635
GHSA-88xj-97gf-7wpq https://github.com/advisories/GHSA-88xj-97gf-7wpq
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://access.redhat.com/security/cve/CVE-2025-3635
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T15:43:11Z/ Found at https://access.redhat.com/security/cve/CVE-2025-3635
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359709
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T15:43:11Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359709
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/moodle/moodle/commit/dbd723f81c07423d4082d54cd1d90b1b68c44379
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://moodle.org/mod/forum/discuss.php?d=467597
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-3635
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.02128
EPSS Score 0.00016
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:12:11.757572+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-88xj-97gf-7wpq/GHSA-88xj-97gf-7wpq.json 36.1.3