CVE-2025-3637CWE-598

Moodle: csrf token exposure via url in moodle mod_data module

Low · published April 25, 2025

CVSS v3.1
3.1
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data module: edit and delete pages.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.7th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2025-04-25T14:42Z
EPSS history
Timeline
  • 25 APR 14:42Z
    Moodle: csrf token exposure via url in moodle mod_data module
    cvelistv5