GitHub Advisoryadvisory · Packagist

GHSA-qhc7-xhc2-7p7w Moodle self enrollment available before completing second factor with MFA enabled

MEDIUM Published 2025-04-25 Modified 2025-04-25 Official page ↗
Aliases
CVE-2025-3634
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-287
Reviewed
2025-04-25

Affected packages

• Packagist moodle/moodle: >= 4.3.0-beta, < 4.3.12 → fixed in 4.3.12 • Packagist moodle/moodle: >= 4.4.0-beta, < 4.4.8 → fixed in 4.4.8 • Packagist moodle/moodle: >= 4.5.0-beta, < 4.5.4 → fixed in 4.5.4

Description

A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.

Related

Alias · CVE (1)

  • CVE-2025-3634 A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References