Moodle has reflected Cross-site Scripting risk in policy tool

MOYENNE 5.4CVE-2025-3643 · BIT-moodle-2025-3643 · GHSA-hxgg-4qww-85ph · Published 25/04/2025 · updated 17/06/2026

En bref

CVE-2025-3643 est une vulnérabilité MOYENNE (CVSS 5.4) touchant moodle/moodle, moodle (moodle).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.8% des vulnérabilités.
Correctif : mettre à jour vers 4.3.12, 4.4.8, 4.5.4, 4.1.18 ou plus récent.

Package	Affected versions	Patched versions
moodle/moodle Packagist	`≥ 4.3.0-beta, < 4.3.12≥ 4.4.0-beta, < 4.4.8≥ 4.5.0-beta, < 4.5.4< 4.1.18`	`4.3.124.4.84.5.44.1.18`
moodle moodle	`≥ 4.3.0, < 4.3.12≥ 4.4.0, < 4.4.8≥ 4.5.0, < 4.5.4< 4.1.18`	`4.3.124.4.84.5.44.1.18`

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk.

NVD description

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 4.3.0-beta, < 4.3.12≥ 4.4.0-beta, < 4.4.8≥ 4.5.0-beta, < 4.5.4< 4.1.18

4.3.124.4.84.5.44.1.18

≥ 4.3.0, < 4.3.12≥ 4.4.0, < 4.4.8≥ 4.5.0, < 4.5.4< 4.1.18

4.3.124.4.84.5.44.1.18

Description

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk.

NVD description

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk.

Autres vulnérabilités de moodle/moodle

Tout voir →