GHSA-p2cj-86v4-7782 BIT-moodle-2024-38275 CVE-2024-38275
Moodle HTTP authorization header is preserved between "emulated redirects"
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.45%
- Chance of exploitation in the next 30 days. Higher than 38.73% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-226 Sensitive Information in Resource Not Removed Before Reuse
- CWE-459 Incomplete Cleanup
- Fix
4.4.1- Upgrade moodle/moodle to this version or later
Description
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| moodle/moodle | >= 4.4.0-beta, < 4.4.1 |
4.4.1 |
| moodle/moodle | >= 4.3.0-beta, < 4.3.5 |
4.3.5 |
| moodle/moodle | >= 4.2.0-beta, < 4.2.8 |
4.2.8 |
| moodle/moodle | < 4.1.11 |
4.1.11 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
moodle/moodle Packagist → 4.4.1
- composer
composer require moodle/moodle:^4.4.1
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
How to prevent it
- Architecture and Design, Implementation: During critical state transitions, information not needed in the next state should be removed or overwritten with fixed patterns (such as all 0's) or random data, before the transition to the next state.
- Architecture and Design, Implementation: When releasing, de-allocating, or deleting a resource, overwrite its data and relevant metadata with fixed patterns or random data. Be cautious about complex resource types whose underlying representation might be non-contiguous or change at a low level, such as how a file might be split into different chunks on a file system, even though "logical" file positions are contiguous at the application layer. Such resource types might require invocation of special modes or APIs to tell the underlying operating system to perform the necessary clearing, such as SDelete (Secure Delete) on Windows, although the appropriate functionality might not be available at the application layer.
CWE-459: Incomplete Cleanup
The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
How to prevent it
- Architecture and Design, Implementation: Temporary files and other supporting resources should be deleted/released immediately after they are no longer needed.
References
Advisories
Packages
Other links
- github.com/moodle/moodle/commit/0df3c5837a592e6663c4d531ff6a1f776bc2f785
- github.com/moodle/moodle/commit/3e38c84315a7991ce5ef5f241f5e873b5ca24f01
- github.com/moodle/moodle/commit/836b2c23a210317d130017d77bb64e3b510869a9
- github.com/moodle/moodle/commit/f7988538b2208c55f2c40ce4f0815901dc88049b
- moodle.org/mod/forum/discuss.php
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-cg8j-5cr2-568q Moodle TeX formula editor is vulnerable to DoS through lack of execution time limits | Medium | Also affects moodle/moodle |
| GHSA-ggxq-2mg9-8966 Moodle has a Remote Code Execution risk via file restore | High | Also affects moodle/moodle |
| GHSA-8jrv-wx83-w3xj Moodle Inserts Sensitive Information Into Sent Data | Medium | Also affects moodle/moodle |
| GHSA-hcm6-q6pc-xfhm Moodle has an authorization logic flaw | Critical | Also affects moodle/moodle |
| GHSA-vwhw-vp9v-q9c9 Moodle vulnerable to Cross-site Scripting | Medium | Also affects moodle/moodle |
| GHSA-5cx4-w4fh-fr57 Moodle Affected by Improper Restriction of Excessive Authentication Attempts | High | Also affects moodle/moodle |
| GHSA-qv78-6gpp-hm68 Moodle Open Redirect vulnerability | Medium | Also affects moodle/moodle |
| GHSA-qfh6-h7j6-fvjv Moodle formula injection vulnerability | High | Also affects moodle/moodle |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor