CVE-2025-32044: Moodle Information Disclosure Flaw

CVE-2025-32044 Overview

A significant information disclosure vulnerability has been identified in Moodle, the widely-used open-source learning management system. This flaw allows unauthenticated users to retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. The vulnerability stems from improper handling of exception information that exposes sensitive data to unauthorized parties.

Critical Impact

Unauthenticated attackers can harvest sensitive user credentials and personal information from vulnerable Moodle installations, potentially leading to account compromise and privacy breaches.

Affected Products

• Moodle LMS (multiple versions)
• Moodle installations without zend.exception_ignore_args = 1 PHP configuration
• Self-hosted Moodle deployments with default PHP exception handling

Discovery Timeline

• 2025-04-25 - CVE-2025-32044 published to NVD
• 2025-06-24 - Last updated in NVD database

Technical Details for CVE-2025-32044

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw exists in how Moodle handles exceptions during API calls, where stack trace information containing sensitive user data is returned to unauthenticated requesters.

When certain API endpoints encounter errors, the application generates detailed stack traces that inadvertently include function arguments. These arguments may contain sensitive user information such as usernames, email addresses, and hashed passwords that were being processed at the time of the exception. The network-accessible nature of this vulnerability means attackers require no authentication or user interaction to exploit it.

Root Cause

The root cause lies in PHP's default exception handling behavior combined with Moodle's API error responses. When exceptions occur during API processing, PHP's default behavior is to include function arguments in stack traces. Moodle's API responses inadvertently expose these detailed stack traces to requesters, including unauthenticated users.

Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected because this setting strips function arguments from exception stack traces.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker can craft specific API requests designed to trigger exceptions within Moodle's processing logic. When these exceptions occur, the error response contains stack trace information that may include sensitive user data being processed by the application at that moment.

The vulnerability does not require any privileges or user interaction, making it particularly dangerous for internet-facing Moodle installations. The confidentiality impact is high as attackers can obtain sensitive user credentials and personal information.

Detection Methods for CVE-2025-32044

Indicators of Compromise

• Unusual volume of API requests resulting in error responses from Moodle endpoints
• Multiple failed or malformed API calls from single IP addresses or ranges
• Evidence of stack trace data being transmitted in HTTP responses
• Anomalous access patterns targeting known vulnerable API endpoints

Detection Strategies

• Monitor web server logs for repeated API error responses (HTTP 500 status codes) to the same endpoints
• Implement web application firewall rules to detect and alert on responses containing stack trace patterns
• Review access logs for unauthenticated requests to sensitive API endpoints
• Deploy network traffic analysis to identify exfiltration of credential-like data patterns

Monitoring Recommendations

• Enable detailed logging for Moodle API endpoints and review for anomalous patterns
• Configure alerting for high volumes of application errors from external sources
• Implement rate limiting on API endpoints to slow potential exploitation attempts
• Monitor for known scanning tools and reconnaissance activity targeting Moodle installations

How to Mitigate CVE-2025-32044

Immediate Actions Required

• Configure PHP with zend.exception_ignore_args = 1 in the php.ini file to prevent argument exposure in stack traces
• Review and apply the latest Moodle security patches from the vendor
• Restrict access to Moodle API endpoints using network-level controls where possible
• Audit user accounts for potential compromise if exploitation is suspected

Patch Information

Administrators should consult the official Moodle security advisories and apply the latest security updates. Additional information is available through Red Hat's CVE-2025-32044 advisory and Red Hat Bug Report #2356829.

Organizations running Moodle should ensure they are running the latest patched version and have implemented the recommended PHP configuration hardening.

Workarounds

• Set zend.exception_ignore_args = 1 in your PHP configuration (php.ini) to prevent sensitive data from appearing in stack traces
• Implement a reverse proxy or web application firewall to filter out detailed error responses before they reach clients
• Consider disabling detailed error reporting in production environments by setting display_errors = Off in PHP configuration
• Restrict network access to Moodle installations using firewall rules to limit exposure while patches are applied

# PHP configuration hardening for php.ini
# Add or modify these settings to mitigate CVE-2025-32044

zend.exception_ignore_args = 1
display_errors = Off
log_errors = On
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT