CVE-2025-32044

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-32044
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32044.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-32044
Aliases
Downstream
Published
2025-04-25T14:43:22.142Z
Modified
2026-07-15T01:48:51.328958826Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Moodle: unauthenticated rest api user data exposure
Details

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exceptionignoreargs = 1 in the php.ini file are not affected by this vulnerability.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.5.0"
                },
                {
                    "last_affected": "4.5.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-200"
    ],
    "cna_assigner": "fedora",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32044.json"
}
References

Affected packages

Git / github.com/moodle/moodle

Affected ranges

Type
GIT
Repo
https://github.com/moodle/moodle
Events
Introduced
52c0da7c647bd6ba8c5f61882d88959821a1fb41
Fixed
b3931cdb959b928eefa72cd5638c3a89d221828f
Database specific 
{
    "cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "4.5.0"
        },
        {
            "fixed": "4.5.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v4.*
v4.5.0
v4.5.1
v4.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-32044.json"