| Package | Affected versions | Patched versions |
|---|---|---|
| moodle/moodle | ≥ 4.2.0-beta, < 4.2.8≥ 4.3.0-beta, < 4.3.5≥ 4.4.0-beta, < 4.4.1< 4.1.11 | 4.2.84.3.54.4.14.1.11 |
| moodle | = 4.4.0≥ 4.2.0, < 4.2.8≥ 4.3.0, < 4.3.5< 4.1.11 | 4.2.84.3.54.1.11 |
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free