CVE-2025-3635: CSRF when duplicating user tours in Moodle
Anyone managing user tours in Moodle could have a tour duplicated without noticing, just by visiting a third-party page. The link behind the action never checked whether the click came from Moodle itself.
1Summary
- Advisory
- MSA-25-0018
- System
- Moodle
- Component
- User tours (tool_usertours)
- Class
- Cross-site request forgery (CSRF)
- Severity
- Minor
User tours are the guided walkthroughs Moodle uses to lead new users through the interface. In tour management, every tour has a link next to it that creates a copy.
That link carried no sesskey token, and the page it pointed to did not ask for one. To Moodle, a request sent from another website therefore was indistinguishable from a click inside its own interface.
Reported by Vincent Schneider through the Moodle security process, published as MSA-25-0018.
2Who is affected
Logged-in users with access to user tour management.
The copy is created in the browser of someone who is logged in to Moodle and allowed to manage tours. Opening a prepared page is enough, for instance through a link in an email, and whoever runs that page needs no account of their own.
3Impact
The outcome is an extra copy of an existing tour in the tour list, which someone has to remove by hand.
4Fix
- Affected versions
- 4.5.0 to 4.5.3, 4.4.0 to 4.4.7, 4.3.0 to 4.3.11, 4.1.17 and earlier
- Fixed in
- 4.5.4, 4.4.8, 4.3.12, 4.1.18
- Published
- 22 Apr 2025
- Fix in the source
- dbd723f
The duplicate link now includes the token. Before the tour is copied, require_sesskey() checks that it belongs to the current session.
We check for this class of flaw in every project we build or audit. For third-party code as a security audit.
5 / Contact
Should we review your Moodle plugins?
Describe your project in three short steps. We usually reply within one business day.