CVE-2024-43432
Moodle: authorization headers preserved between "emulated redirects"
Résumé
Moodle: authorization headers preserved between "emulated redirects"
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
moodle
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.1.12"},{"introduced":"4.2.0"},{"fixed":"4.2.9"},{"introduced":"4.3.0"},{"fixed":"4.3.6"},{"introduced":"4.4.0"},{"fixed":"4.4.2"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- report bugzilla.redhat.com
- web moodle.org