GHSA-m367-445c-2xqr
Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository
At a glance
- Published
- Updated
- CVE
- CVE-2025-3642
- Aliases
- BIT-moodle-2025-3642
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By default, this was only available to teachers and managers on sites with the EQUELLA repository enabled.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 0, fixed 4.1.18 |
| Packagist · moodle/moodle | introduced 4.3.0-beta, fixed 4.3.12 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.8 |
| Packagist · moodle/moodle | introduced 4.5.0-beta, fixed 4.5.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-3642 ADVISORY
- https://github.com/moodle/moodle/commit/630fbf6230ee18d63ce69bea34173fb151b599da WEB
- https://access.redhat.com/security/cve/CVE-2025-3642 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2359738 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=467603 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |