7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-32044

CVE-2025-32044: Moodle allows unauthenticated REST API user data exposure

A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites where PHP is configured with zend.exception_ignore_args = 'On' or zend.exception_ignore_args = 1 in the relevant php.ini file are NOT affected by this vulnerability. Sites that do not have the zend.exception_ignore_args setting enabled and are using the internal Moodle LMS authentication system are affected by this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-32044

CVE-2025-32044:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
moodle/moodle	composer	>= 4.5.0-beta, < 4.5.3	4.5.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability describes unauthenticated user data exposure via stack traces in API calls. The provided commit (41917db65e6b3dba3bf3d805a8599e6752655646) directly addresses this by modifying how stack traces are handled.

Analysis of lib/classes/router/response/exception_response.php:
- The function get_payload_data within the class core_router\response\exception_response (namespace derived from Moodle's file structure and common practice, confirmed by checking Moodle source) was changed.
- Previously, it assigned $exception->getTrace() directly to the stacktrace field in the response. This raw trace could include function arguments if zend.exception_ignore_args was not set in PHP's configuration.
- The fix explicitly filters out 'args' from each frame of the stack trace using array_map and array_filter.
- This directly points to core_router\response\exception_response::get_payload_data as the function responsible for preparing the vulnerable stack trace output.
Analysis of lib/setup.php:
- This file was modified to enforce ini_set('zend.exception_ignore_args', '1');. This is a global mitigation strategy to prevent arguments from appearing in any stack trace by default.
- While this change is crucial for the fix, it doesn't pinpoint a specific Moodle function that is vulnerable but rather a configuration Moodle now enforces to protect itself. The vulnerability exists in how Moodle handles exceptions when this PHP setting is not active, which leads back to get_payload_data.
Analysis of lib/tests/classes/router/route_testcase.php:
- The test function assert_exception_response was updated to assert that 'args' are not present in the stack trace, confirming the fix in get_payload_data.

The primary function that would appear in a runtime profile during the exploitation (i.e., when the sensitive data is being packaged into the response) is core_router\response\exception_response::get_payload_data. The vulnerability isn't that this function itself takes malicious input, but that it handles exception objects in a way that, under certain PHP configurations, leaks sensitive data that originated from arguments of other functions higher in the call stack during an API request that led to an exception.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.