Moodle User Data Exposure Vulnerability via Unauthenticated API Calls

A vulnerability exists in Moodle versions 4.5 to 4.5.2, allowing unauthenticated users to access sensitive user information, such as names, contact details, and hashed passwords. This data exposure occurs through stack traces generated by certain API calls. However, sites with PHP configured to ignore exception arguments are not vulnerable.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive user information, including names, contact details, and hashed passwords.

Remediation

Users can upgrade to Moodle version 4.5.3 to address this vulnerability.