Patchwire CVEs, their patch status, and feeds to follow them

CVE-2024-43432

Fixed upstream EPSS <1%CVSS 5.3

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

Published 2024-11-11 · CVE record · OSV

Products: Moodle

Fixed upstream

EcosystemPackageFixed in
Packagistmoodle/moodle4.4.2
Packagistmoodle/moodle4.3.6
Packagistmoodle/moodle4.2.9
Packagistmoodle/moodle4.1.12

Distro releases

ReleasePackageFixed in
Ubuntu Pro 16.04 LTSmoodleno fix
Ubuntu Pro 18.04 LTSmoodleno fix