CVE-2024-43432: Moodle: authorization headers preserved between "emulated redirects"
Published Nov 11, 2024
·Updated
A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Affected Software
8 affected componentsFixes available
composer/moodle/moodle<4.1.12
4.1.12
composer/moodle/moodle>=4.2.0<4.2.9
4.2.9
composer/moodle/moodle>=4.3.0<4.3.6
4.3.6
composer/moodle/moodle>=4.4.0<4.4.2
4.4.2
Moodle moodle<4.1.12
Moodle moodle>=4.2.0<4.2.9
Moodle moodle>=4.3.0<4.3.6
Moodle moodle>=4.4.0<4.4.2
Event History
Nov 11, 2024
CVE Published
via MITRE·12:16 PM
Data Sourced
via MITRE·12:16 PM
DescriptionSeverity
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·03:31 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-43432?
CVE-2024-43432 is classified as a medium severity vulnerability.
2
How can I fix CVE-2024-43432?
To fix CVE-2024-43432, upgrade your Moodle installation to version 4.1.12, 4.2.9, 4.3.6, or 4.4.2.
3
What does CVE-2024-43432 affect?
CVE-2024-43432 affects the cURL wrapper in Moodle by potentially leaking HTTP authorization data.
4
What are the implications of CVE-2024-43432?
The implications of CVE-2024-43432 include the accidental exposure of sensitive HTTP authorization headers to redirect URLs.
5
Which versions of Moodle are impacted by CVE-2024-43432?
CVE-2024-43432 impacts Moodle versions prior to 4.1.12, 4.2.9, 4.3.6, and 4.4.2.