A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2304260 | Permissions Required |
| https://moodle.org/mod/forum/discuss.php?d=461200 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
01 May 2025, 16:08
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Moodle
Moodle moodle |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2304260 - Permissions Required | |
| References | () https://moodle.org/mod/forum/discuss.php?d=461200 - Vendor Advisory | |
| CPE | cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* |
11 Nov 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-11 13:15
Updated : 2025-05-01 16:08
NVD link : CVE-2024-43432
Mitre link : CVE-2024-43432
JSON object : View
Products Affected
moodle
- moodle
CWE
No CWE.