{"affected":[{"affectedData":[{"collectionURL":"https://git.moodle.org","defaultStatus":"unaffected","packageName":"moodle","versions":[{"lessThan":"4.5.4","status":"affected","version":"4.5.0","versionType":"semver"},{"lessThan":"4.4.8","status":"affected","version":"4.4.0","versionType":"semver"},{"lessThan":"4.3.12","status":"affected","version":"4.3.0","versionType":"semver"}]}],"source":"patrick@puiterwijk.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","matchCriteriaId":"BF438B80-5736-46ED-897E-726B563F8E0A","versionEndExcluding":"4.3.12","versionStartIncluding":"4.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","matchCriteriaId":"E758F51B-ADBF-406E-92A8-98090BE83C2B","versionEndExcluding":"4.4.8","versionStartIncluding":"4.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*","matchCriteriaId":"F12B5C6F-A83C-488C-9C26-3C9A61F93618","versionEndExcluding":"4.5.4","versionStartIncluding":"4.5.0","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A security vulnerability was discovered in Moodle that allows students to enroll themselves in courses without completing all the necessary safety checks. Specifically, users can sign up for courses prematurely, even if they haven't finished two-step verification processes."},{"lang":"es","value":"Se descubrió una vulnerabilidad de seguridad en Moodle que permite a los estudiantes inscribirse en cursos sin completar todas las comprobaciones de seguridad necesarias. En concreto, los usuarios pueden inscribirse en cursos de forma anticipada, incluso sin haber completado la verificación en dos pasos."}],"id":"CVE-2025-3634","lastModified":"2026-06-17T09:20:21.640","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":1.4,"source":"patrick@puiterwijk.org","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-3634","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-04-25T14:23:56.228314Z","version":"2.0.3"}}]},"published":"2025-04-25T14:15:22.917","references":[{"source":"patrick@puiterwijk.org","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2025-3634"},{"source":"patrick@puiterwijk.org","tags":["Issue Tracking"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2359707"}],"sourceIdentifier":"patrick@puiterwijk.org","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"patrick@puiterwijk.org","type":"Secondary"}]}