The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NMoodle
APPMoodle4.4.0< 4.1.114.2.0 – 4.2.8 (bez)4.3.0 – 4.3.5 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Powiązane podatności
CVE-2024-33999CRITICAL9.8PL ✓ten sam produkt
Moodle MFA — niewystarczająca sanityzacja URL referrer
CVE-2023-28333CRITICAL9.8ten sam produkt
The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This ...
CVE-2021-36392CRITICAL9.8ten sam produkt
In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.
CVE-2021-36393CRITICAL9.8ten sam produkt
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
CVE-2021-36394CRITICAL9.8ten sam produkt
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.