FKIE_CVE-2025-32044

Vulnerability from fkie_nvd - Published: 2025-04-25 15:15 - Updated: 2025-06-24 16:16
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability.
References
patrick@puiterwijk.orghttps://access.redhat.com/security/cve/CVE-2025-32044Third Party Advisory
patrick@puiterwijk.orghttps://bugzilla.redhat.com/show_bug.cgi?id=2356829Issue Tracking
Impacted products
Vendor Product Version
moodle moodle *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FD20A49-9A06-419E-AEDB-C794994A6C99",
              "versionEndExcluding": "4.5.3",
              "versionStartIncluding": "4.5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data\u2014including names, contact information, and hashed passwords\u2014via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una falla en Moodle donde, en ciertos sitios, usuarios no autenticados pod\u00edan recuperar datos confidenciales de usuario (como nombres, informaci\u00f3n de contacto y contrase\u00f1as cifradas) mediante seguimientos de pila devueltos por llamadas API espec\u00edficas. Los sitios con PHP configurado con zend.exception_ignore_args = 1 en el archivo php.ini no se ven afectados por esta vulnerabilidad."
    }
  ],
  "id": "CVE-2025-32044",
  "lastModified": "2025-06-24T16:16:26.330",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "patrick@puiterwijk.org",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-04-25T15:15:36.170",
  "references": [
    {
      "source": "patrick@puiterwijk.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://access.redhat.com/security/cve/CVE-2025-32044"
    },
    {
      "source": "patrick@puiterwijk.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2356829"
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "patrick@puiterwijk.org",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.