4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3636

CVE-2025-3636: Moodle allows IDOR in RSS block, which allows access to additional RSS feeds

A flaw was found in Moodle. This vulnerability allows unauthorized users to access and view RSS feeds due to insufficient capability checks.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3636

CVE-2025-3636:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	< 4.1.18	4.1.18
moodle/moodle	composer	>= 4.3.0-beta, < 4.3.12	4.3.12
moodle/moodle	composer	>= 4.4.0-beta, < 4.4.8	4.4.8
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.4	4.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch (commit 0bd97209ac5e217dbec236c73e4f6fdcaee1c737) for Moodle's blocks/rss_client/viewfeed.php script reveals the source of the IDOR vulnerability.

Vulnerable Code Path: The script viewfeed.php is the entry point for viewing RSS feeds.
Lack of Authorization: Before the patch, the script fetched RSS feed data using $rssrecord = $DB->get_record('block_rss_client', array('id' => $rssid), '*', MUST_EXIST);. This line retrieved the feed based only on the user-supplied rssid, without checking if the current user ($USER->id) had the right to access that particular feed. While there was a check to disallow guest users, other authenticated users could access any feed if they knew its ID.
Patch Mechanics: The patch rectifies this by:
- Introducing capability checks: has_capability('block/rss_client:manageanyfeeds', $context) and require_capability('block/rss_client:manageownfeeds', $context).
- Changing the database query to be conditional based on these capabilities. It now uses $DB->get_record_select with a $select clause that filters by userid and shared status, ensuring that users can only access feeds they own or shared feeds if they have the manageanyfeeds capability.

Therefore, the script blocks/rss_client/viewfeed.php itself is identified as the vulnerable component because its logic directly handled the user request and performed the data retrieval without sufficient authorization checks, leading to the IDOR. The specific line removed in the patch (- $rssrecord = $DB->get_record('block_rss_client', array('id' => $rssid), '*', MUST_EXIST);) is the direct evidence of the vulnerable operation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.