Description

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Remediation

References

CVE-2024-43432

Related Vulnerabilities

Oracle JRE CVE-2018-2794 Vulnerability (CVE-2018-2794)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-2068)

Oracle Application Server CVE-2009-0996 Vulnerability (CVE-2009-0996)

Oracle Database Server CVE-2014-6563 Vulnerability (CVE-2014-6563)

WordPress Plugin WP Hardening-Fix Your WordPress Security Cross-Site Scripting (1.2.1)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-319 CVE-2024-43432