Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-38275

Date: June 18, 2024

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Language: PHP

Severity Score

Related Resources (8)

https://moodle.org/mod/forum/discuss.php?d=459500
https://github.com/moodle/moodle/commit/f7988538b2208c55f2c40ce4f0815901dc88049b
https://github.com/moodle/moodle/commit/0df3c5837a592e6663c4d531ff6a1f776bc2f785
https://github.com/moodle/moodle
https://nvd.nist.gov/vuln/detail/CVE-2024-38275
https://github.com/moodle/moodle/commit/3e38c84315a7991ce5ef5f241f5e873b5ca24f01
https://github.com/moodle/moodle/commit/836b2c23a210317d130017d77bb64e3b510869a9
https://www.mend.io/vulnerability-database/CVE-2024-38275

Severity Score

Weakness Type (CWE)

Sensitive Information in Resource Not Removed Before Reuse

CWE-226

Incomplete Cleanup

CWE-459

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us