Moodle HTTP Authorization Header Retention Vulnerability
Summary
CVE-2024-38275: Moodle HTTP authorization header is preserved between "emulated redirects". Affects moodle/moodle across 4 version ranges.
< 4.1.11
>= 4.2.0-beta, < 4.2.8
>= 4.3.0-beta, < 4.3.5
>= 4.4.0-beta, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-38275 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used by educational institutions worldwide. It provides a platform for creating and managing online courses, allowing educators to deliver content and engage with students. The vulnerability in question affects the cURL wrapper in Moodle, which is responsible for handling HTTP requests. This vulnerability allows the preservation of the HTTP authorization header during "emulated redirects", potentially leading to unintended disclosure of sensitive information.
Vulnerability Detail
The cURL wrapper in Moodle retains the original request headers when following redirects. This means that if an initial request includes an HTTP authorization header, it will be unintentionally sent in subsequent requests to redirect URLs. This could result in the exposure of sensitive information, such as user credentials or access tokens, to unintended recipients. The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.114.1.11composer require moodle/moodle:4.1.11 -
>= 4.2.0-beta, < 4.2.84.2.8composer require moodle/moodle:4.2.8 -
>= 4.3.0-beta, < 4.3.54.3.5composer require moodle/moodle:4.3.5 -
>= 4.4.0-beta, < 4.4.14.4.1composer require moodle/moodle:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix provided by upgrading to the latest version of Moodle.
Conclusion
The Moodle HTTP Authorization Header Retention Vulnerability allows the unintended disclosure of sensitive information. Users of Moodle should upgrade to version 4.4.1 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
The vulnerability allows the unintentional disclosure of sensitive information, such as user credentials or access tokens.
Upgrade to Moodle version 4.4.1 or later to apply the necessary fix.
No, there is no known workaround. Upgrading to the fixed version is the recommended solution.
The vulnerability has a CVSS score of 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
