CVE-2025-62396: Moodle's error handling leads to sensitive information disclosure
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
Other sources
Improper error handling in the routing mechanism could result in directory listings being returned to clients when “Accept: text/html” headers were missing. This could expose file structure or sensitive information about the application environment.
Versions affected: 5.0 to 5.0.2 and 4.5 to 4.5.6 Versions fixed: 5.0.3 and 4.5.7
— Red Hat
Moodle's error handling leads to sensitive information disclosure
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.5.7 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 5.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.5.7
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62396?
CVE-2025-62396 is classified as a moderate severity vulnerability.
How does CVE-2025-62396 affect Moodle?
CVE-2025-62396 affects Moodle by potentially exposing internal directory listings due to improper HTTP header configurations.
How do I fix CVE-2025-62396?
To fix CVE-2025-62396, ensure proper configuration of HTTP headers in the Moodle router (r.php).
What versions of Moodle are affected by CVE-2025-62396?
CVE-2025-62396 affects all versions of Moodle that utilize the r.php router.
What is the primary risk associated with CVE-2025-62396?
The primary risk of CVE-2025-62396 is the potential exposure of sensitive internal directory information.