Miembros de
Boletines de Vulnerabilidades |
MSA-24-0033: Authorization headers preserved between "emulated redirects" |
|
| Software afectado | PHP |
|
by Michael Hawkins. The cURL wrapper in Moodle stripped HTTPAUTH and USERPWD headers during emulated redirects, but retained other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.Severity/Risk:MinorVersions affected:4.4 to 4.4.1, 4.3 to 4.3.5, 4.2 to 4.2.8, 4.1 to 4.1.11 and earlier unsupported versionsVersions fixed:4.4.2, 4.3.6, 4.2.9 and 4.1.12Reported by:Marina GlancyCVE identifier:CVE-2024-43432Changes More info: https://moodle.org/mod/forum/discuss.php?d=461200&parent=1851871 |
|
