CVE-2024-38275
18.06.2024, 20:15
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.Enginsight
| Vendor | Product | Version |
|---|---|---|
| moodle | moodle | 𝑥 < 4.1.11 |
| moodle | moodle | 4.2.0 ≤ 𝑥 < 4.2.8 |
| moodle | moodle | 4.3.0 ≤ 𝑥 < 4.3.5 |
| moodle | moodle | 4.4.0 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
- CWE-226 - Sensitive Information in Resource Not Removed Before ReuseThe product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
- CWE-459 - Incomplete CleanupThe software does not properly "clean up" and remove temporary or supporting resources after they have been used.