Sign in
Deutsch English Español Polski
Medium

Cross-Site Request Forgery in Moodle

  • Disclosed: 23.11.2022
  • Updated: 11.10.2026 10:22

A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an attacker to perform cross-site request forgery attacks.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package moodle/moodle >= 3.9.0, < 3.9.18, >= 3.11.0, < 3.11.11, >= 4.0.0, < 4.0.5 3.9.18, 3.11.11, 4.0.5

References

CVSS score 5.4/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness (CWE)
CWE-352
Platform
Composer
Package
moodle/moodle
Disclosed
23.11.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-8v23-w4w5-w83c - CC BY 4.0

Vulnerability history: moodle/moodle

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (437) in the archive
Total entries
437
First → latest
03.2021 02.2026
Without a fix
10
Exploited in attacks
0

Severity breakdown

  • Critical 16
  • High 68
  • Medium 318
  • Low 35

Disclosures per year

Severity:
  1. Cross-Site Request Forgery in Moodle this entry
    Medium · 5.4 CVE-2022-45149 >= 3.9.0, < 3.9.18, >= 3.11.0, < 3.11.11, >= 4.0.0, < 4.0.5 3.9.18, 3.11.11, 4.0.5
  2. Moodle has a Remote Code Execution risk via file restore
    High · 7.2 CVE-2026-26045 >= 5.1.0-beta, < 5.1.2, >= 5.0.0-beta, < 5.0.5, < 4.5.9 5.1.2, 5.0.5, 4.5.9
  3. Moodle Affected by Improper Restriction of Excessive Authentication Attempts
    High · 7.5 CVE-2025-67853 < 4.1.22, >= 4.4.0-beta, < 4.4.12, >= 4.5.0-beta, < 4.5.8, >= 5.0.0-beta, < 5.0.4, >= 5.1.0-beta, < 5.1.1 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  4. Moodle authentication bypass vulnerability
    High · 8.1 CVE-2025-67848 < 4.1.22, >= 4.4.0-beta, < 4.4.12, >= 4.5.0-beta, < 4.5.8, >= 5.0.0-beta, < 5.0.4, >= 5.1.0-beta, < 5.1.1 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  5. Moodle Cross-site Scripting (XSS) vulnerability
    High · 7.3 CVE-2025-67849 < 4.1.22, >= 4.4.0-beta, < 4.4.12, >= 4.5.0-beta, < 4.5.8, >= 5.0.0-beta, < 5.0.4, >= 5.1.0-beta, < 5.1.1 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  6. Moodle vulnerable to Cross-site Scripting
    High · 7.3 CVE-2025-67850 < 4.1.22, >= 4.4.0-beta, < 4.4.12, >= 4.5.0-beta, < 4.5.8, >= 5.0.0-beta, < 5.0.4, >= 5.1.0-beta, < 5.1.1 4.1.22, 4.4.12, 4.5.8, 5.0.4, 5.1.1
  7. Moodle affected by a code injection vulnerability
    High · 8.8 CVE-2025-67847 >= 5.1.0-beta, < 5.1.1, >= 5.0.0-beta, < 5.0.4, >= 4.5.0-beta, < 4.5.8, >= 4.2.0-beta, < 4.4.12, < 4.1.22 5.1.1, 5.0.4, 4.5.8, 4.4.12, 4.1.22
  8. Moodle vulnerable to brute-force password guesses
    High · 7.5 CVE-2025-62399 >= 5.0.0-beta, < 5.0.3, >= 4.5.0-beta, < 4.5.7, >= 4.2.0-beta, < 4.4.11, < 4.1.21 5.0.3, 4.5.7, 4.4.11, 4.1.21
  9. Moodle has an authenticated remote code execution risk in the Moodle LMS EQUELLA repository
    High · 8.8 CVE-2025-3642 < 4.1.18, >= 4.3.0-beta, < 4.3.12, >= 4.4.0-beta, < 4.4.8, >= 4.5.0-beta, < 4.5.4 4.1.18, 4.3.12, 4.4.8, 4.5.4
  10. Moodle has an authenticated remote code execution risk in the Moodle LMS Dropbox repository
    High · 8.8 CVE-2025-3641 < 4.1.18, >= 4.3.0-beta, < 4.3.12, >= 4.4.0-beta, < 4.4.8, >= 4.5.0-beta, < 4.5.4 4.1.18, 4.3.12, 4.4.8, 4.5.4
  11. Moodle allows unauthenticated REST API user data exposure
    High · 7.5 CVE-2025-32044 >= 4.5.0-beta, < 4.5.3 4.5.3
  12. Moodle allows reflected XSS via question bank filter
    High · 8.3 CVE-2025-26530 >= 4.5.0-beta, < 4.5.2, >= 4.4.0-beta, < 4.4.6, >= 4.3.0-beta, < 4.3.10 4.5.2, 4.4.6, 4.3.10
  13. Moodle has a stored XSS risk in admin live log
    High · 8.3 CVE-2025-26529 >= 4.5.0-beta, < 4.5.2, >= 4.4.0-beta, < 4.4.6, >= 4.3.0-beta, < 4.3.10, < 4.1.16 4.5.2, 4.4.6, 4.3.10, 4.1.16
  14. Moodle has an arbitrary file read risk through pdfTeX
    High · 8.6 CVE-2025-26525 >= 4.5.0-beta, < 4.5.2, >= 4.4.0-beta, < 4.4.6, >= 4.3.0-beta, < 4.3.10, < 4.1.16 4.5.2, 4.4.6, 4.3.10, 4.1.16
  15. Moodle has a SQL injection risk in course search module list filter
    High · 8.1 CVE-2025-26533 >= 4.5.0-beta, < 4.5.2, >= 4.4.0-beta, < 4.4.6, >= 4.3.0-beta, < 4.3.10, < 4.1.16 4.5.2, 4.4.6, 4.3.10, 4.1.16
  16. Moodle Remote Code Execution vulnerability
    High · 8.1 CVE-2024-43425 < 4.1.12, >= 4.2.0-beta, < 4.2.9, >= 4.3.0-beta, < 4.3.6, >= 4.4.0-beta, < 4.4.2 4.1.12, 4.2.9, 4.3.6, 4.4.2
  17. Moodle has CSRF risk in Feedback non-respondents report
    High · 8.1 CVE-2024-43434 < 4.1.12, >= 4.2.0-beta, < 4.2.9, >= 4.3.0-beta, < 4.3.6, >= 4.4.0-beta, < 4.4.2 4.1.12, 4.2.9, 4.3.6, 4.4.2
  18. Moodle ReCAPTCHA can be bypassed on the login page
    High · 7.5 CVE-2024-34009 >= 4.3.0, < 4.3.4 4.3.4
  19. Moodle CSRF risk in analytics management of models
    High · 8.8 CVE-2024-34008 >= 4.3.0, < 4.3.4, >= 4.2.0, < 4.2.7, < 4.1.10 4.3.4, 4.2.7, 4.1.10
  20. Moodle Authenticated LFI risk in some misconfigured shared hosting environments
    High · 6.5 CVE-2024-34005 >= 4.3.0, < 4.3.4, >= 4.2.0, < 4.2.7, < 4.1.10 4.3.4, 4.2.7, 4.1.10
  21. Moodle Authenticated LFI risk in some misconfigured shared hosting environments
    High · 6.5 CVE-2024-34002 >= 4.3.0, < 4.3.4, >= 4.2.0, < 4.2.7, < 4.1.10 4.3.4, 4.2.7, 4.1.10
Show more (20) Showing 21 of 85

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.