CVE-2025-62396 - Vulnerability Details - OpenCVE

An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Moodle	Moodle

No data.

No data.

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2025-62396
https://bugzilla.redhat.com/show_bug.cgi?id=2404429

History

Fri, 24 Oct 2025 10:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Moodle Moodle moodle
Vendors & Products		Moodle Moodle moodle

Thu, 23 Oct 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 23 Oct 2025 11:45:00 +0000

Type	Values Removed	Values Added
Description		An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
Title		Moodle: router (r.php) could expose application directories
Weaknesses		CWE-548
References		https://access.redhat.com/security/cve/CVE-2025-62396 https://bugzilla.redhat.com/show_bug.cgi?id=2404429
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2025-10-23T11:28:31.054Z

Updated: 2025-10-23T14:13:02.325Z

Reserved: 2025-10-13T10:12:30.925Z

Link: CVE-2025-62396

Vulnrichment

Updated: 2025-10-23T14:12:58.854Z

NVD

Status : Awaiting Analysis

Published: 2025-10-23T12:15:31.913

Modified: 2025-10-27T13:20:33.350

Link: CVE-2025-62396

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62396", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "state": "PUBLISHED", "assignerShortName": "fedora", "dateReserved": "2025-10-13T10:12:30.925Z", "datePublished": "2025-10-23T11:28:31.054Z", "dateUpdated": "2025-10-23T14:13:02.325Z"}, "containers": {"cna": {"title": "Moodle: router (r.php) could expose application directories", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured."}], "affected": [{"versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.3", "versionType": "semver"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.7", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-62396", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404429", "name": "RHBZ#2404429", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2025-10-14T04:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-548", "description": "Exposure of Information Through Directory Listing", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-548: Exposure of Information Through Directory Listing", "timeline": [{"lang": "en", "time": "2025-10-16T14:25:44.556000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-10-14T04:00:00+00:00", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank Yedidia Klein for reporting this issue."}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2025-10-23T11:28:31.054Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-23T14:12:55.991738Z", "id": "CVE-2025-62396", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-23T14:13:02.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62396", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-23T14:12:55.991738Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-23T14:12:58.854Z"}}], "cna": {"title": "Moodle: router (r.php) could expose application directories", "credits": [{"lang": "en", "value": "Red Hat would like to thank Yedidia Klein for reporting this issue."}], "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.0.3", "versionType": "semver"}, {"status": "affected", "version": "4.5.0", "lessThan": "4.5.7", "versionType": "semver"}], "packageName": "moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-16T14:25:44.556000+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2025-10-14T04:00:00+00:00", "value": "Made public."}], "datePublic": "2025-10-14T04:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-62396", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404429", "name": "RHBZ#2404429", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "descriptions": [{"lang": "en", "value": "An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-548", "description": "Exposure of Information Through Directory Listing"}]}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2025-10-23T11:28:31.054Z"}, "x_redhatCweChain": "CWE-548: Exposure of Information Through Directory Listing"}}, "cveMetadata": {"cveId": "CVE-2025-62396", "state": "PUBLISHED", "dateUpdated": "2025-10-23T14:13:02.325Z", "dateReserved": "2025-10-13T10:12:30.925Z", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "datePublished": "2025-10-23T11:28:31.054Z", "assignerShortName": "fedora"}, "dataVersion": "5.1"}