5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3643

CVE-2025-3643: Moodle has reflected Cross-site Scripting risk in policy tool

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting (XSS) risk.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3643

CVE-2025-3643:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	< 4.1.18	4.1.18
moodle/moodle	composer	>= 4.3.0-beta, < 4.3.12	4.3.12
moodle/moodle	composer	>= 4.4.0-beta, < 4.4.8	4.4.8
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.4	4.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability description indicates an XSS risk due to improper sanitization of a return URL in the policy tool. The provided commit ff9bbd6d9e7d6267ce85e6c9afbeb19581f2a85f directly addresses this by modifying the clean_param_value_localurl function in lib/classes/param.php. The patch strengthens the regular expression used to detect and block javascript: URLs. This implies that the previous version of this function was the point where the sanitization failed, making it the vulnerable function. The function is part of the core_param class. The confidence is high because the commit directly patches this function to fix the described XSS vulnerability by improving the sanitization logic for local URLs, which aligns with the vulnerability description about a return URL in the policy tool needing additional sanitizing. The function name clean_param_value_localurl clearly indicates its role in processing URL parameters, which are a common vector for XSS if not handled correctly. The patch evidence shows the exact change in the sanitization logic (the regex).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.