GitHub Advisoryadvisory · Packagist

GHSA-p2cj-86v4-7782 Moodle HTTP authorization header is preserved between "emulated redirects"

MEDIUM Published 2024-06-18 Modified 2025-05-01 Official page ↗
Aliases
CVE-2024-38275
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-226, CWE-459
Reviewed
2024-06-18

Affected packages

• Packagist moodle/moodle: >= 4.4.0-beta, < 4.4.1 → fixed in 4.4.1 • Packagist moodle/moodle: >= 4.3.0-beta, < 4.3.5 → fixed in 4.3.5 • Packagist moodle/moodle: >= 4.2.0-beta, < 4.2.8 → fixed in 4.2.8 • Packagist moodle/moodle: < 4.1.11 → fixed in 4.1.11

Description

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Related

Alias · CVE (1)

  • CVE-2024-38275 The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could… vulnerability

Weakness · CWE (2)

  • CWE-226 Sensitive Information in Resource Not Removed Before Reuse weakness
  • CWE-459 Incomplete Cleanup weakness

References