VYPR
← All advisories
High severity7.5NVD Advisory· Published Jun 18, 2024· Updated Jun 17, 2026

CVE-2024-38275

CVE-2024-38275

Description

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
moodle/moodlePackagist
>= 4.4.0-beta, < 4.4.14.4.1
moodle/moodlePackagist
>= 4.3.0-beta, < 4.3.54.3.5
moodle/moodlePackagist
>= 4.2.0-beta, < 4.2.84.2.8
moodle/moodlePackagist
< 4.1.114.1.11

Affected products

5
  • Moodle/Moodle3 versions
    cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*range: <4.1.11
    • cpe:2.3:a:moodle:moodle:4.4.0:*:*:*:*:*:*:*
    • (no CPE)range: 4.4
  • osv-coords2 versions
    pkg:bitnami/moodlepkg:composer/moodle/moodle
    < 4.1.11+ 1 more
    • (no CPE)range: < 4.1.11
    • (no CPE)range: >= 4.4.0-beta, < 4.4.1

Patches

Vulnerability mechanics

References

7

News mentions

0

No linked articles in our index yet.