UBUNTU-CVE-2024-38275

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2024-38275

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38275.json

JSON Data

https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2024-38275

Upstream

CVE-2024-38275

Published

2024-06-18T20:15:00Z

Modified

2025-10-24T05:10:14Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

References

Affected packages

Ubuntu:16.04:LTS / moodle

Package

Name: moodle
Purl: pkg:deb/ubuntu/moodle@3.0.3+dfsg-0ubuntu1?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.7.9+dfsg-1

2.7.10+dfsg-1

2.7.11+dfsg-1

2.7.11+dfsg-2

2.7.12+dfsg-1

3.*

3.0.3+dfsg-0ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "3.0.3+dfsg-0ubuntu1",
            "binary_name": "moodle"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-38275.json"

Ubuntu:18.04:LTS / moodle