CVE-2024-38275

moodle: HTTP authorization header is preserved between "emulated redirects"

State: Published
Severity: 7.5 High
Published: Jun 18, 2024
Updated: Aug 2, 2024
Reserved: Jun 12, 2024

Description

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-226

Affected Products

Product	Versions
MoodleMoodle	4.4Affected 4.3 through 4.3.4Affected 4.2 through 4.2.7Affected 4.1 through 4.1.10Affected

References

https://moodle.org/mod/forum/discuss.php?d=459500

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.