4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-3647

CVE-2025-3647: Moodle allows IDOR when accessing the cohorts report

A flaw was discovered in Moodle. Additional checks were required to ensure that users can only access cohort data they are authorized to retrieve.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-3647

CVE-2025-3647:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	< 4.1.18	4.1.18
moodle/moodle	composer	>= 4.3.0-beta, < 4.3.12	4.3.12
moodle/moodle	composer	>= 4.4.0-beta, < 4.4.8	4.4.8
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.4	4.5.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) where user-supplied 'contextid' parameters were not properly validated against the user's permissions. The analysis of the provided commit (bd6ec0ac84cf0f73ab35e7e244e1f9b06929083a) shows changes in the 'cohort/classes/reportbuilder/local/systemreports/cohorts.php' file. Specifically, the methods 'initialise', 'can_view', and 'add_actions' were modified to stop using the 'contextid' parameter directly from the input and instead rely on the current user's context ($this->get_context()). These methods were responsible for fetching data, checking permissions, and generating URLs based on the potentially manipulated 'contextid', making them vulnerable. The changes in 'cohort/index.php' are related to how this 'cohorts' class is instantiated, removing the direct passing of 'contextid' as a report parameter, relying on the internal fixes within the 'cohorts' class methods.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.