Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-38275

Fixed upstream EPSS <1%CVSS 7.5

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Published 2024-06-18 · CVE record · OSV

Products: Moodle

Fixed upstream

EcosystemPackageFixed in
Packagistmoodle/moodle4.4.1
Packagistmoodle/moodle4.3.5
Packagistmoodle/moodle4.2.8
Packagistmoodle/moodle4.1.11

Distro releases

ReleasePackageFixed in
Ubuntu Pro 16.04 LTSmoodleno fix
Ubuntu Pro 18.04 LTSmoodleno fix