GitHub Advisoryadvisory · Packagist

GHSA-345q-9jmq-g9q4 Moodle allows unauthenticated REST API user data exposure

HIGH Published 2025-04-25 Modified 2025-04-25 Official page ↗
Aliases
CVE-2025-32044
Ecosystem
Packagist
Packages
moodle/moodle
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2025-04-25

Affected packages

• Packagist moodle/moodle: >= 4.5.0-beta, < 4.5.3 → fixed in 4.5.3

Description

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites where PHP is configured with zend.exception_ignore_args = 'On' or zend.exception_ignore_args = 1 in the relevant php.ini file are NOT affected by this vulnerability. Sites that do not have the zend.exception_ignore_args setting enabled and are using the internal Moodle LMS authentication system are affected by this vulnerability.

Related

Alias · CVE (1)

  • CVE-2025-32044 A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names,… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References