GHSA-qhc7-xhc2-7p7w
Moodle self enrollment available before completing second factor with MFA enabled
At a glance
- Published
- Updated
- CVE
- CVE-2025-3634
- Aliases
- BIT-moodle-2025-3634
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Description
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 4.3.0-beta, fixed 4.3.12 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.8 |
| Packagist · moodle/moodle | introduced 4.5.0-beta, fixed 4.5.4 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-3634 ADVISORY
- https://github.com/moodle/moodle/commit/b0965139014b459c3cb96e4fff45af4d5e09e261 WEB
- https://access.redhat.com/security/cve/CVE-2025-3634 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2359707 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=467596 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |