CVE-2025-3634

low-risk

Published 2025-04-25

A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes.

Do I need to act?

0.32% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Moodle

Affected Vendors

Moodle

References (2)

Third Party Advisory https://access.redhat.com/security/cve/CVE-2025-3634

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2359707

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal