Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ey6g-spfk-7bcw
Vulnerability ID VCID-ey6g-spfk-7bcw
Aliases CVE-2025-62396
GHSA-c5cj-xp43-qcc3
Summary Moodle's error handling leads to sensitive information disclosure An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-548 Exposure of Information Through Directory Listing
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.3 https://access.redhat.com/security/cve/CVE-2025-62396
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2025-62396
ssvc Track https://access.redhat.com/security/cve/CVE-2025-62396
epss 0.00043 https://api.first.org/data/v1/epss?cve=CVE-2025-62396
cvssv3.1 5.3 https://bugzilla.redhat.com/show_bug.cgi?id=2404429
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2404429
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2404429
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-c5cj-xp43-qcc3
cvssv3.1 5.3 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 5.3 https://github.com/moodle/moodle/commit/5d4910509eeaac8403d18ec8f259e29d2f11527e
generic_textual MODERATE https://github.com/moodle/moodle/commit/5d4910509eeaac8403d18ec8f259e29d2f11527e
cvssv3.1 5.3 https://github.com/moodle/moodle/commit/5e7d5abc483d0511ebfc2042075eabcc392ff4ce
generic_textual MODERATE https://github.com/moodle/moodle/commit/5e7d5abc483d0511ebfc2042075eabcc392ff4ce
cvssv3.1 5.3 https://moodle.org/mod/forum/discuss.php?d=470385
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=470385
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-62396
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-62396
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-62396
https://bugzilla.redhat.com/show_bug.cgi?id=2404429
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/5d4910509eeaac8403d18ec8f259e29d2f11527e
https://github.com/moodle/moodle/commit/5e7d5abc483d0511ebfc2042075eabcc392ff4ce
https://moodle.org/mod/forum/discuss.php?d=470385
CVE-2025-62396 https://access.redhat.com/security/cve/CVE-2025-62396
CVE-2025-62396 https://nvd.nist.gov/vuln/detail/CVE-2025-62396
GHSA-c5cj-xp43-qcc3 https://github.com/advisories/GHSA-c5cj-xp43-qcc3
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://access.redhat.com/security/cve/CVE-2025-62396
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:12:55Z/ Found at https://access.redhat.com/security/cve/CVE-2025-62396
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2404429
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-10-23T14:12:55Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2404429
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/5d4910509eeaac8403d18ec8f259e29d2f11527e
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/moodle/moodle/commit/5e7d5abc483d0511ebfc2042075eabcc392ff4ce
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=470385
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-62396
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.13593
EPSS Score 0.00043
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:48:14.496536+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/moodle/moodle/CVE-2025-62396.yml 38.6.0