CVE-2024-43432: Moodle: authorization headers preserved between "emulated redirects"
First published: Mon Nov 11 2024(Updated: )
A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Credit: patrick@puiterwijk.org patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | <4.1.12 | 4.1.12 |
| composer/moodle/moodle | >=4.2.0<4.2.9 | 4.2.9 |
| composer/moodle/moodle | >=4.3.0<4.3.6 | 4.3.6 |
| composer/moodle/moodle | >=4.4.0<4.4.2 | 4.4.2 |
| Moodle | <4.1.12 | |
| Moodle | >=4.2.0<4.2.9 | |
| Moodle | >=4.3.0<4.3.6 | |
| Moodle | >=4.4.0<4.4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-43432?
CVE-2024-43432 is classified as a medium severity vulnerability.
How can I fix CVE-2024-43432?
To fix CVE-2024-43432, upgrade your Moodle installation to version 4.1.12, 4.2.9, 4.3.6, or 4.4.2.
What does CVE-2024-43432 affect?
CVE-2024-43432 affects the cURL wrapper in Moodle by potentially leaking HTTP authorization data.
What are the implications of CVE-2024-43432?
The implications of CVE-2024-43432 include the accidental exposure of sensitive HTTP authorization headers to redirect URLs.
Which versions of Moodle are impacted by CVE-2024-43432?
CVE-2024-43432 impacts Moodle versions prior to 4.1.12, 4.2.9, 4.3.6, and 4.4.2.
- agent/title
- agent/first-publish-date
- agent/type
- agent/description
- agent/severity
- agent/weakness
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7wmp-2xmx-g6h8
- alias/CVE-2024-43432
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-api
- package-manager/composer
- vendor/moodle
- canonical/moodle
- version/moodle/4.2.0
- version/moodle/4.3.0
- version/moodle/4.4.0