CVE-2024-43432 MEDIUM

CVE-2024-43432: Moodle: authorization headers preserved between "emulated redirects"

Published November 11, 2024
Last update November 12, 2024
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Key dates

02Disclosure timeline

November 11, 2024 CVE published
November 12, 2024 Record updated