Moodle up to 3.11.18 sesskey session fixiation

Summaryinfo

A vulnerability was found in Moodle up to 3.11.18. It has been declared as critical. This affects an unknown part. The manipulation of the argument sesskey results in session fixiation. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability was named CVE-2025-53021. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Moodle up to 3.11.18. Affected is some unknown processing. The manipulation of the argument sesskey with an unknown input leads to a session fixiation vulnerability. CWE is classifying the issue as CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The advisory is shared for download at rentry.co. This vulnerability is traded as CVE-2025-53021 since 06/24/2025. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/25/2025).

Upgrading to version 3.11.18 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19060). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Learning Management Software

Name

• Moodle

Version

• 3.11.0
• 3.11.1
• 3.11.2
• 3.11.3
• 3.11.4
• 3.11.5
• 3.11.6
• 3.11.7
• 3.11.8
• 3.11.9
• 3.11.10
• 3.11.11
• 3.11.12
• 3.11.13
• 3.11.14
• 3.11.15
• 3.11.16
• 3.11.17
• 3.11.18

License

• open-source

Support

• end of life

Website

• Product: https://moodle.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion