CVE-2025-32044: Moodle Information Disclosure Flaw

CVE-2025-32044 Overview

A significant information disclosure vulnerability has been identified in Moodle, the widely-used open-source learning management system. This flaw allows unauthenticated users to retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. The vulnerability stems from improper handling of exception information that exposes sensitive data to unauthorized parties.

Critical Impact
Unauthenticated attackers can harvest sensitive user credentials and personal information from vulnerable Moodle installations, potentially leading to account compromise and privacy breaches.

Affected Products

Moodle LMS (multiple versions)
Moodle installations without zend.exception_ignore_args = 1 PHP configuration
Self-hosted Moodle deployments with default PHP exception handling

Discovery Timeline

2025-04-25 - CVE-2025-32044 published to NVD
2025-06-24 - Last updated in NVD database

Technical Details for CVE-2025-32044

Vulnerability Analysis

This vulnerability falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw exists in how Moodle handles exceptions during API calls, where stack trace information containing sensitive user data is returned to unauthenticated requesters.

When certain API endpoints encounter errors, the application generates detailed stack traces that inadvertently include function arguments. These arguments may contain sensitive user information such as usernames, email addresses, and hashed passwords that were being processed at the time of the exception. The network-accessible nature of this vulnerability means attackers require no authentication or user interaction to exploit it.

Root Cause

The root cause lies in PHP's default exception handling behavior combined with Moodle's API error responses. When exceptions occur during API processing, PHP's default behavior is to include function arguments in stack traces. Moodle's API responses inadvertently expose these detailed stack traces to requesters, including unauthenticated users.

Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected because this setting strips function arguments from exception stack traces.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker can craft specific API requests designed to trigger exceptions within Moodle's processing logic. When these exceptions occur, the error response contains stack trace information that may include sensitive user data being processed by the application at that moment.

The vulnerability does not require any privileges or user interaction, making it particularly dangerous for internet-facing Moodle installations. The confidentiality impact is high as attackers can obtain sensitive user credentials and personal information.

Detection Methods for CVE-2025-32044

Indicators of Compromise

Unusual volume of API requests resulting in error responses from Moodle endpoints
Multiple failed or malformed API calls from single IP addresses or ranges
Evidence of stack trace data being transmitted in HTTP responses
Anomalous access patterns targeting known vulnerable API endpoints

Detection Strategies

Monitor web server logs for repeated API error responses (HTTP 500 status codes) to the same endpoints
Implement web application firewall rules to detect and alert on responses containing stack trace patterns
Review access logs for unauthenticated requests to sensitive API endpoints
Deploy network traffic analysis to identify exfiltration of credential-like data patterns

Monitoring Recommendations

Enable detailed logging for Moodle API endpoints and review for anomalous patterns
Configure alerting for high volumes of application errors from external sources
Implement rate limiting on API endpoints to slow potential exploitation attempts
Monitor for known scanning tools and reconnaissance activity targeting Moodle installations

How to Mitigate CVE-2025-32044

Immediate Actions Required

Configure PHP with zend.exception_ignore_args = 1 in the php.ini file to prevent argument exposure in stack traces
Review and apply the latest Moodle security patches from the vendor
Restrict access to Moodle API endpoints using network-level controls where possible
Audit user accounts for potential compromise if exploitation is suspected

Patch Information

Administrators should consult the official Moodle security advisories and apply the latest security updates. Additional information is available through Red Hat's CVE-2025-32044 advisory and Red Hat Bug Report #2356829.

Organizations running Moodle should ensure they are running the latest patched version and have implemented the recommended PHP configuration hardening.

Workarounds

Set zend.exception_ignore_args = 1 in your PHP configuration (php.ini) to prevent sensitive data from appearing in stack traces
Implement a reverse proxy or web application firewall to filter out detailed error responses before they reach clients
Consider disabling detailed error reporting in production environments by setting display_errors = Off in PHP configuration
Restrict network access to Moodle installations using firewall rules to limit exposure while patches are applied

bash

# PHP configuration hardening for php.ini
# Add or modify these settings to mitigate CVE-2025-32044

zend.exception_ignore_args = 1
display_errors = Off
log_errors = On
error_reporting = E_ALL & ~E_DEPRECATED & ~E_STRICT