CVE-2025-62396
Info Disclosure in Moodle 4.5.0 – 4.5.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2025-62396 is a medium-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability in Moodle Moodle. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Discovery (T1083); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SI-11 (Error Handling) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35671
Vulnerability Data
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in Moodle's router (r.php) enables unauthorized exposure of internal directory listings due to improper error handling when specific HTTP headers (e.g., Accept: text/html) are missing, directly facilitating File and Directory Discovery (T1083).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires configuring web server/router settings (including HTTP headers and directory listing behavior) to prevent exposure of internal paths.
Requires proper error handling in components such as r.php so that failures do not leak directory listings or internal structure.
Enforces information flow rules that can block unauthorized disclosure of directory contents via misconfigured headers or error paths.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and config management directly disable directory listing by default.
Lifecycle management includes applying secure configurations that would prevent directory exposure.
Vulnerability scanning can discover exposed directories so they can be remediated.
Least-privilege access rules can restrict who sees directory contents but do not address the listing feature itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information access restriction directly prevents directory listings by enforcing need-to-know access controls on web resources.
Security testing in development and acceptance can detect and require remediation of exposed directory listings.
Network security measures such as disabling directory indexing on web servers reduce exposure of directory contents.
Secure development life cycle includes configuration hardening that disables directory listing in production web servers.
Application security requirements can mandate disabling directory indexing and enforcing proper access controls on web directories.
Secure system architecture principles include configuring web servers to prevent automatic directory listings.