CVE-2025-62396
Info Disclosure in Moodle 4.5.0 – 4.5.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-62396 is a medium-severity Exposure of Information Through Directory Listing (CWE-548) vulnerability in Moodle Moodle. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Discovery (T1083); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35671
Vulnerability Data
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires secure baseline settings that disable directory listing on servers and file shares.
Restricts unnecessary server features such as automatic directory indexing.
Enforces authorization decisions so that directory listings are never returned unless explicitly permitted.
Controls information flows so directory contents are not disclosed to unauthorized recipients.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened baselines and config management directly disable directory listing by default.
Lifecycle management includes applying secure configurations that would prevent directory exposure.
Vulnerability scanning can discover exposed directories so they can be remediated.
Least-privilege access rules can restrict who sees directory contents but do not address the listing feature itself.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information access restriction directly prevents directory listings by enforcing need-to-know access controls on web resources.
Security testing in development and acceptance can detect and require remediation of exposed directory listings.
Network security measures such as disabling directory indexing on web servers reduce exposure of directory contents.
Secure development life cycle includes configuration hardening that disables directory listing in production web servers.
Application security requirements can mandate disabling directory indexing and enforcing proper access controls on web directories.
Secure system architecture principles include configuring web servers to prevent automatic directory listings.