CVE-2025-32044CWE-200

Moodle: unauthenticated rest api user data exposure

High · published April 25, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00514 · 43.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-04-25T14:43Z
EPSS history
Timeline
  • 25 APR 14:43Z
    Moodle: unauthenticated rest api user data exposure
    cvelistv5