CVEvulnerability

CVE-2024-38275

7.5 HIGH Published 2024-06-18 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-06-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-226, CWE-459

Description

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Affected configurations

• moodle moodle (< 4.1.11) • moodle moodle (>= 4.2.0 < 4.2.8) • moodle moodle (>= 4.3.0 < 4.3.5) • moodle moodle 4.4.0

Related

Weakness · CWE (2)

  • CWE-226 Sensitive Information in Resource Not Removed Before Reuse weakness
  • CWE-459 Incomplete Cleanup weakness

References