Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2024-38275

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

VectorNETWORK

PublishedJun 18, 2024, 20:15

Published Bypatrick@puiterwijk.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

moodle/moodle(Packagist)4.4.0-beta4.4.1N/A

moodle/moodle(Packagist)4.3.0-beta4.3.5N/A

moodle/moodle(Packagist)4.2.0-beta4.2.8N/A

moodle/moodle(Packagist)04.1.11N/A

References

https://moodle.org/mod/forum/discuss.php?d=459500

Weakness Type

CWE-459

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK