CVE-2025-32044
Moodle: unauthenticated rest api user data exposure
Résumé
Moodle: unauthenticated rest api user data exposure
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"4.5.0"},{"fixed":"4.5.3"}]}]
Références
- advisory access.redhat.com
- advisory nvd.nist.gov
- advisory github.com
- package git.moodle.org
- report bugzilla.redhat.com