VYPR
← All advisories
High severity7.5OSV Advisory· Published Apr 25, 2025· Updated Jun 17, 2026

CVE-2025-32044

CVE-2025-32044

Description

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 4.5.0-beta, < 4.5.34.5.3

Affected products

4
  • Moodle/MoodleOSV2 versions
    v4.5.0, v4.5.1, v4.5.2+ 1 more
    • (no CPE)range: v4.5.0, v4.5.1, v4.5.2
    • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: >=4.5.0,<4.5.3
  • osv-coords2 versions
    pkg:bitnami/moodlepkg:composer/moodle/moodle
    >= 4.5.0, < 4.5.3+ 1 more
    • (no CPE)range: >= 4.5.0, < 4.5.3
    • (no CPE)range: >= 4.5.0-beta, < 4.5.3

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.