5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-67855

CVE-2025-67855: Mooodle: mooodle: information disclosure and script execution via reflected cross-site scripting

A flaw was found in mooodle. A remote attacker could exploit a reflected Cross-Site Scripting (XSS) vulnerability in the policy tool return URL. This vulnerability arises from insufficient sanitization of URL parameters, allowing attackers to inject malicious scripts through specially crafted links. Successful exploitation could lead to information disclosure or arbitrary client-side script execution within the user's browser.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-67855

CVE-2025-67855:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	< 4.1.22	4.1.22
moodle/moodle	composer	>= 4.4.0-beta, < 4.4.12	4.4.12
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.8	4.5.8
moodle/moodle	composer	>= 5.0.0-beta, < 5.0.4	5.0.4
moodle/moodle	composer	>= 5.1.0-beta, < 5.1.1	5.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided patch clearly indicates that the vulnerability is located in the clean_param_value_localurl function within the public/lib/classes/param.php file. The commit 0c146aa2612fb6d0544f200a018cb42da75db713 directly addresses a Cross-Site Scripting (XSS) vulnerability by modifying the regular expression used for URL validation. The change from !preg_match('/javascript(?:.*\\/{2,})?:/i', rawurldecode($param)) to !preg_match('/\\bjavascript\\b[\\s\\S]*?(?:\\:|\\/)/i', rawurldecode($param)) shows that the original regex was too permissive and could be bypassed. The vulnerable function, core_param::clean_param_value_localurl, would be present in the runtime profile when a user interacts with a feature that uses this validation, such as the policy tool's return URL. An attacker could exploit this by crafting a URL that, when clicked by a victim, would execute a malicious script in the context of the victim's browser session.

Vulnerable functions

core_param::clean_param_value_localurl

public/lib/classes/param.php

The vulnerability lies in the `clean_param_value_localurl` function, which is responsible for sanitizing local URL parameters. The original implementation used an insufficient regular expression to detect and block `javascript:` URIs. This allowed an attacker to craft a malicious URL that would bypass the filter and execute arbitrary JavaScript in the user's browser. The patch replaces the weak regex with a more robust one that correctly identifies and blocks malicious `javascript:` payloads.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.