4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3628

CVE-2025-3628: Moodle reveals student identities through assignment submissions search on anonymous submissions

A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3628

CVE-2025-3628:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.4	4.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis focused on the provided commit 5c703f7b4944dd0cc940ca20adfd91e6a2d98a66, which addresses the vulnerability. The commit modifies the mod/assign/classes/output/grading_actionmenu.php file. The key changes are in the export_for_template method. A new check, $isblind = $this->assign->is_blind_marking() && !$this->hasviewblind;, is introduced. Based on this $isblind flag, the $usersearch variable is conditionally anonymized, and the $userid passed to the user_selector is conditionally set to null. This clearly indicates that before these changes, the function did not adequately handle cases where blind marking was active but the viewing user lacked the mod/assign:viewblinddetails capability. In such scenarios, if a user ID was resolved (e.g., via the 'search' parameter mentioned in the vulnerability description), their real name would be used for $usersearch and their ID for the user_selector, thus de-anonymizing the submission. The __construct method was also updated to fetch the hasviewblind capability, which is used by export_for_template to implement the fix. Therefore, mod_assign\output\grading_actionmenu::export_for_template is identified as the vulnerable function where the de-anonymization occurred.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.