CVE-2025-53021
Quick assessment
Affected
Moodle Moodle
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Moodle是Moodle开源的一套免费的电子学习软件平台，也称课程管理系统、学习管理系统或虚拟学习环境。 Moodle 3.x至3.11.18版本存在授权问题漏洞，该漏洞源于会话固定漏洞允许未经验证的攻击者通过sesskey参数劫持用户会话。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-53021
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
会话固定
Source: CVE Program / CVE List V5
Vulnerability Title
Moodle 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Moodle是Moodle开源的一套免费的电子学习软件平台，也称课程管理系统、学习管理系统或虚拟学习环境。 Moodle 3.x至3.11.18版本存在授权问题漏洞，该漏洞源于会话固定漏洞允许未经验证的攻击者通过sesskey参数劫持用户会话。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-53021
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-53021
请登录查看更多情报信息。
Vendor Pages for CVE-2025-53021 (1)
Same Patch Batch · Moodle · 2025-06-24 · 3 CVEs total
| CVE-2025-34031 | Moodle LMS Jmol Plugin Path Traversal | |
| CVE-2025-34032 | Moodle LMS Jmol Plugin Cross-site Scripting (XSS) |
IV. Related Vulnerabilities
Same product: Moodle
-
CVE-2021-47857
Moodle 3.10.3 - 'label' Persistent Cross Site Scripting -
CVE-2025-26533
SQL injection risk in course search module list filter -
CVE-2025-26532
Teachers can evade trusttext config when restoring glossary -
CVE-2025-26531
IDOR in badges allows disabling of arbitrary badges -
CVE-2025-26530
Reflected XSS via question bank filter
Same vendor: Moodle
-
CVE-2022-50943
Moodle LMS 4.0 Cross-Site Scripting via course search.php -
CVE-2021-47857
Moodle 3.10.3 - 'label' Persistent Cross Site Scripting -
CVE-2025-34032
Moodle LMS Jmol Plugin Cross-site Scripting (XSS) -
CVE-2025-34031
Moodle LMS Jmol Plugin Path Traversal -
CVE-2024-38277
moodle: QR login key and auto-login key for the Moodle mobil
Same weakness: CWE-384
-
CVE-2026-104469
YesWiki before 4.6.7 Session Fixation via Login in AuthContr -
CVE-2026-71302
Toptech TMS7 and TopHAT Session Fixation -
CVE-2026-92609
Apache Qpid Broker-J: Missing HTTP-session renewal after suc -
CVE-2026-57179
social-auth-core has a Session Fixation issue -
CVE-2026-95828
Mstfakts College-Management-System Authentication server.php
V. Comments for CVE-2025-53021
No comments yet