Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-rcr9-z41f-sqbr
Vulnerability ID VCID-rcr9-z41f-sqbr
Aliases CVE-2025-3637
GHSA-9vc3-vm42-fjhm
Summary Moodle's mod_data edit/delete pages pass CSRF token in GET parameter A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-598 Use of GET Request Method With Sensitive Query Strings
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 3.1 http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356
generic_textual LOW http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356
ssvc Track http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356
cvssv3.1 3.1 https://access.redhat.com/security/cve/CVE-2025-3637
generic_textual LOW https://access.redhat.com/security/cve/CVE-2025-3637
ssvc Track https://access.redhat.com/security/cve/CVE-2025-3637
epss 0.00129 https://api.first.org/data/v1/epss?cve=CVE-2025-3637
cvssv3.1 3.1 https://bugzilla.redhat.com/show_bug.cgi?id=2359727
generic_textual LOW https://bugzilla.redhat.com/show_bug.cgi?id=2359727
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2359727
cvssv3.1 3.1 https://github.com/moodle/moodle
generic_textual LOW https://github.com/moodle/moodle
cvssv3.1 3.1 https://github.com/moodle/moodle/commit/052007b7324ef24aebe36a876ffa4fa97fac4f81
generic_textual LOW https://github.com/moodle/moodle/commit/052007b7324ef24aebe36a876ffa4fa97fac4f81
cvssv3.1 3.1 https://moodle.org/mod/forum/discuss.php?d=467599
generic_textual LOW https://moodle.org/mod/forum/discuss.php?d=467599
cvssv3.1 3.1 https://nvd.nist.gov/vuln/detail/CVE-2025-3637
generic_textual LOW https://nvd.nist.gov/vuln/detail/CVE-2025-3637
Reference id Reference type URL
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356
https://api.first.org/data/v1/epss?cve=CVE-2025-3637
https://bugzilla.redhat.com/show_bug.cgi?id=2359727
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/052007b7324ef24aebe36a876ffa4fa97fac4f81
https://moodle.org/mod/forum/discuss.php?d=467599
CVE-2025-3637 https://access.redhat.com/security/cve/CVE-2025-3637
CVE-2025-3637 https://nvd.nist.gov/vuln/detail/CVE-2025-3637
GHSA-9vc3-vm42-fjhm https://github.com/advisories/GHSA-9vc3-vm42-fjhm
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Found at http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T15:43:02Z/ Found at http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-65356
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/security/cve/CVE-2025-3637
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T15:43:02Z/ Found at https://access.redhat.com/security/cve/CVE-2025-3637
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359727
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-25T15:43:02Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359727
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/052007b7324ef24aebe36a876ffa4fa97fac4f81
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=467599
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-3637
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.31915
EPSS Score 0.00129
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:23:53.887137+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/moodle/moodle/CVE-2025-3637.yml 38.6.0