CVE-2025-53021

24.06.2025, 20:15

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	4.2 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
mitre	CNA	4.2 MEDIUM				CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 34%

Vendor	Product	Version
moodle	moodle	3.0.0 ≤ 𝑥 ≤ 3.11.18

𝑥

= Vulnerable software versions

Ubuntu Releases

Ubuntu Product

Codename

moodle

plucky	dne
oracular	dne
noble	dne
jammy	dne
bionic	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-384 - Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References

https://github.com/moodle/moodle/releases/tag/v3.11.18

https://moodledev.io/general/releases#moodle-311

https://rentry.co/moodle-oauth2-cve