CVE-2024-38275CWE-226

moodle: HTTP authorization header is preserved between "emulated redirects"

High · published June 18, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
37.8
In the wild
Unconfirmed
What it is

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00445 · 37.8th percentile
Weakness
CWE-226 · Sensitive Information in Resource Not Removed Before Reuse
Published
2024-06-18T19:49Z
EPSS history
Timeline
  • 18 JUN 19:49Z
    moodle: HTTP authorization header is preserved between "emulated redirects"
    cvelistv5