CVE-2024-38275
moodle: HTTP authorization header is preserved between "emulated redirects"
Summary
moodle: HTTP authorization header is preserved between "emulated redirects"
Original description
The description as published by the source.
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.11"},{"introduced":"4.2.0"},{"fixed":"4.2.8"},{"introduced":"4.3.0"},{"fixed":"4.3.5"},{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}]
References
- advisory moodle.org
- web nvd.nist.gov