CVE-2025-32044 is a vulnerability identified in Moodle version 4.5.0 that allows unauthenticated users to access sensitive user information through improperly handled stack traces returned by specific API calls. Moodle is a widely used open-source learning management system (LMS) deployed globally, including extensively across European educational institutions and organizations. The vulnerability arises when PHP is configured without the directive zend.exception_ignore_args set to 1 in the php.ini file. In such configurations, stack traces generated during error handling expose detailed information, including user names, contact details, and hashed passwords. This exposure occurs because the stack traces inadvertently include sensitive data as part of the error output, which is accessible without authentication. The flaw does not require any user authentication or interaction, making it accessible to any remote attacker who can invoke the vulnerable API endpoints. Although no known exploits are currently reported in the wild, the vulnerability presents a significant risk due to the nature of the data exposed and the ease of exploitation. The vulnerability is classified as medium severity, reflecting the balance between the sensitivity of the data exposed and the conditions required for exploitation. The issue can be mitigated by configuring PHP with zend.exception_ignore_args=1, which prevents sensitive arguments from being included in stack traces, or by applying patches or updates from Moodle once available.

For European organizations, particularly educational institutions, government agencies, and private sector entities using Moodle 4.5.0, this vulnerability poses a risk of unauthorized disclosure of sensitive user information. Exposure of names, contact information, and hashed passwords can facilitate targeted phishing attacks, social engineering, and credential cracking attempts. This could lead to broader compromise of user accounts and unauthorized access to learning resources or internal systems. The confidentiality of personal data is at risk, potentially violating GDPR requirements and leading to legal and reputational consequences. The integrity and availability of Moodle services are less directly impacted; however, the loss of trust and potential follow-on attacks could disrupt operations. Since the vulnerability does not require authentication or user interaction, the attack surface is broad, increasing the likelihood of exploitation if unmitigated. European organizations with large user bases or sensitive data hosted on Moodle platforms are particularly vulnerable to data breaches and subsequent exploitation.

1. Immediately verify the PHP configuration on Moodle servers to ensure zend.exception_ignore_args is set to 1 in the php.ini file, which prevents sensitive data from being included in stack traces. 2. Monitor Moodle vendor communications and apply any official patches or updates addressing this vulnerability as soon as they become available. 3. Restrict access to Moodle API endpoints by implementing network-level controls such as IP whitelisting or VPN access, limiting exposure to trusted users and networks. 4. Implement web application firewalls (WAFs) with rules designed to detect and block suspicious API calls that could trigger stack traces. 5. Conduct regular audits of server error logs and application responses to identify any inadvertent exposure of sensitive information. 6. Educate system administrators and developers about secure PHP error handling practices and the risks of verbose error messages in production environments. 7. Consider additional hardening measures such as disabling detailed error reporting in production and using centralized logging with restricted access to prevent leakage of sensitive data.