Moodle HTTP authorization header is preserved between "emulated redirects"
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-38275US | — | — | ||
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to red… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/0df3c5837a592e6663c4d531ff6a1f776bc2f785WEB
- https://github.com/moodle/moodle/commit/3e38c84315a7991ce5ef5f241f5e873b5ca24f01WEB
- https://github.com/moodle/moodle/commit/836b2c23a210317d130017d77bb64e3b510869a9WEB
- https://github.com/moodle/moodle/commit/f7988538b2208c55f2c40ce4f0815901dc88049bWEB
- https://moodle.org/mod/forum/discuss.php?d=459500WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-38275ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan