Description

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Remediation

References

CVE-2024-38275

Related Vulnerabilities

WordPress Plugin Coming Soon & Maintenance Mode Page Cross-Site Request Forgery (1.57)

WordPress Plugin MalCare Security-Free Malware Scanner, Protection & Security for WordPress Cross-Site Scripting (4.57)

SugarCRM Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2020-17373)

WordPress Plugin Visitor Traffic Real Time Statistics Security Bypass (2.11)

Moodle Improper Privilege Management Vulnerability (CVE-2017-7532)

Severity

High

Classification

CVE-2024-38275 CWE-459 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities