CVE-2024-38275: Moodle HTTP authorization header is preserved between "emulated redirects"
Moodle HTTP authorization header is preserved between "emulated redirects"
Other sources
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.2.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38275?
CVE-2024-38275 has a severity rating that indicates a moderate risk due to the potential exposure of HTTP authorization headers.
How do I fix CVE-2024-38275?
To fix CVE-2024-38275, update your Moodle instance to version 4.1.11 or later, or to any of the remedied versions specific for your current branch.
What software is affected by CVE-2024-38275?
CVE-2024-38275 affects multiple versions of Moodle, specifically those before 4.1.11, as well as versions 4.2.0-beta to 4.2.8, 4.3.0-beta to 4.3.5, and 4.4.0-beta to 4.4.1.
How does CVE-2024-38275 impact users?
CVE-2024-38275 could inadvertently leak sensitive authorization information during HTTP redirects, potentially compromising user credentials.
When was CVE-2024-38275 disclosed?
CVE-2024-38275 was disclosed on October 11, 2024, revealing vulnerabilities that impact Moodle installations.