What the vulnerability does
01Description
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
CVE-2024-38275
CVE-2024-38275: moodle: HTTP authorization header is preserved between "emulated redirects"
CVSS base score
—
Key dates
02Disclosure timeline
June 18, 2024
CVE published
August 2, 2024
Record updated
External resources
