CVE-2025-3634
CVE-2025-3634 · Moodle: moodle allows course self-enrolment before completing mfa
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.
CVSS 4.3 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
moodle/moodle Packagist
- Versions
- v4.3.0
- v4.3.0-beta
- v4.3.0-rc1
- v4.3.0-rc2
- v4.3.1
- v4.3.10
- v4.3.11
- v4.3.2
- v4.3.3
- v4.3.4
- v4.3.5
- v4.3.6
- v4.3.7
- v4.3.8
- v4.3.9
- Affected ranges
- ECOSYSTEM: ≥ 4.3.0-beta, < 4.3.12
Update to 4.3.12
moodle/moodle Packagist
- Versions
- v4.4.0
- v4.4.0-beta
- v4.4.0-rc1
- v4.4.0-rc2
- v4.4.1
- v4.4.2
- v4.4.3
- v4.4.4
- v4.4.5
- v4.4.6
- v4.4.7
- Affected ranges
- ECOSYSTEM: ≥ 4.4.0-beta, < 4.4.8
Update to 4.4.8
moodle/moodle Packagist
- Versions
- v4.5.0
- v4.5.0-beta
- v4.5.0-rc1
- v4.5.0-rc2
- v4.5.1
- v4.5.2
- v4.5.3
- Affected ranges
- ECOSYSTEM: ≥ 4.5.0-beta, < 4.5.4
Update to 4.5.4
moodle Ubuntu:Pro:16.04:LTS
- Versions
- 2.7.9+dfsg-1
- 2.7.10+dfsg-1
- 2.7.11+dfsg-1
- 2.7.11+dfsg-2
- 2.7.12+dfsg-1
- 3.0.3+dfsg-0ubuntu1
- 3.0.3+dfsg-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
moodle Ubuntu:Pro:18.04:LTS
- Versions
- 3.0.3+dfsg-0ubuntu1
- 3.0.3+dfsg-0ubuntu1+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published