← CVE Intelligence

CVE-2024-38275

moodle: HTTP authorization header is preserved between "emulated redirects" PUBLISHED

Description (CNA)

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Affected (CNA)

Vendor / productVersions
Moodle / Moodleaffected 4.4; affected 4.3 through 4.3.4; affected 4.2 through 4.2.7; affected 4.1 through 4.1.10

CWE

CWE-226

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.