CVE-2025-62396

An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-62396	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2404429	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:moodle:moodle::::::::
	cpe:2.3:a:moodle:moodle::::::::

History

27 Oct 2026, 12:10

Type	Values Removed	Values Added
Summary		(es) Un problema de manejo de errores en el router de Moodle (r.php) podría causar que la aplicación mostrara listados de directorios internos cuando ciertos encabezados HTTP no estaban configurados correctamente.

Information

Published : 2025-10-23 12:15

Updated : 2026-10-27 12:10

NVD link : CVE-2025-62396

Mitre link : CVE-2025-62396

CVE.ORG link : CVE-2025-62396

JSON object : View

Products Affected

moodle

moodle

CWE

CWE-548

Exposure of Information Through Directory Listing

{"id": "CVE-2025-62396", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62396", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-23T14:12:55.991738Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "patrick@puiterwijk.org", "affectedData": [{"versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.3", "versionType": "semver"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.7", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unaffected"}]}], "published": "2025-10-23T12:15:31.913", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-62396", "tags": ["Third Party Advisory"], "source": "patrick@puiterwijk.org"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404429", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "patrick@puiterwijk.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "patrick@puiterwijk.org", "description": [{"lang": "en", "value": "CWE-548"}]}], "descriptions": [{"lang": "en", "value": "An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured."}, {"lang": "es", "value": "Un problema de manejo de errores en el router de Moodle (r.php) podr\u00eda causar que la aplicaci\u00f3n mostrara listados de directorios internos cuando ciertos encabezados HTTP no estaban configurados correctamente."}], "lastModified": "2026-10-27T12:10:00.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5414437D-2D9C-4565-853F-EAF761F52E5E", "versionEndExcluding": "4.5.7", "versionStartIncluding": "4.5.0"}, {"criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "672DBB86-D5A8-41B6-B6F3-8E323E9C21F0", "versionEndExcluding": "5.0.3", "versionStartIncluding": "5.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "patrick@puiterwijk.org"}