CVE-2025-32044
Moodle: unauthenticated rest api user data exposure
Summary
Moodle: unauthenticated rest api user data exposure
Original description
The description as published by the source.
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"4.5.0"},{"fixed":"4.5.3"}]}]
References
- advisory access.redhat.com
- advisory nvd.nist.gov
- advisory github.com
- package git.moodle.org
- report bugzilla.redhat.com