CVE-2024-43432

Moodle: authorization headers preserved between "emulated redirects"

State: Published
Severity: 5.3 Medium
Published: Nov 11, 2024
Updated: Nov 12, 2024
Reserved: Aug 13, 2024

Description

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	fedora

Weaknesses

CWE-319 Cleartext Transmission of Sensitive Information

Affected Products

Product	Versions
moodle	before 4.1.12Affected 4.2 to before 4.2.9Affected 4.3 to before 4.3.6Affected 4.4 to before 4.4.2Affected

References

RHBZ#2304260issue-tracking
https://moodle.org/mod/forum/discuss.php?d=461200

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.