CVE-2025-53021 - CVE House
Back to Database
Status published Medium CVE-2025-53021

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows...

Vulnerability Description

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey can be obtained without authentication and reused within the OAuth2 login flow, resulting in the victim's session being linked to the attacker's. Successful exploitation results in full account takeover. According to the Moodle Releases page, "Bug fixes for security issues in 3.11.x ended 11 December 2023." NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53021

Credits & Attribution

No credits recorded in the NVD database.

References

More from Moodle

View All →
CVE-2025-34032
Moodle LMS Jmol Plugin Cross-site Scripting (XSS)
Medium 5.1
CVE-2025-34031
Moodle LMS Jmol Plugin Path Traversal
High 8.7
CVE-2024-38277
moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
Unknown 0
CVE-2024-38276
moodle: CSRF risks due to misuse of confirm_sesskey
Unknown 0
CVE-2024-38275
moodle: HTTP authorization header is preserved between "emulated redirects"
Unknown 0

Affected Vendor

Affected Software

Moodle
Vulnerable Versions:
3

Timeline

Official Publish: June 24th, 2025
Last Modified: June 24th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-384

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1078 Valid Accounts
Persistence
T1539 Steal Web Session Cookie
Credential Access