Search for vulnerabilities
Vulnerability details: VCID-p4rf-gf33-abgw
Vulnerability ID VCID-p4rf-gf33-abgw
Aliases CVE-2024-38275
GHSA-p2cj-86v4-7782
Summary Moodle HTTP authorization header is preserved between "emulated redirects" The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-226 Sensitive Information in Resource Not Removed Before Reuse
CWE-459 Incomplete Cleanup
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00208 https://api.first.org/data/v1/epss?cve=CVE-2024-38275
epss 0.00208 https://api.first.org/data/v1/epss?cve=CVE-2024-38275
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-p2cj-86v4-7782
cvssv3.1 7.5 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 7.5 https://github.com/moodle/moodle/commit/0df3c5837a592e6663c4d531ff6a1f776bc2f785
generic_textual MODERATE https://github.com/moodle/moodle/commit/0df3c5837a592e6663c4d531ff6a1f776bc2f785
cvssv3.1 7.5 https://github.com/moodle/moodle/commit/3e38c84315a7991ce5ef5f241f5e873b5ca24f01
generic_textual MODERATE https://github.com/moodle/moodle/commit/3e38c84315a7991ce5ef5f241f5e873b5ca24f01
cvssv3.1 7.5 https://github.com/moodle/moodle/commit/836b2c23a210317d130017d77bb64e3b510869a9
generic_textual MODERATE https://github.com/moodle/moodle/commit/836b2c23a210317d130017d77bb64e3b510869a9
cvssv3.1 7.5 https://github.com/moodle/moodle/commit/f7988538b2208c55f2c40ce4f0815901dc88049b
generic_textual MODERATE https://github.com/moodle/moodle/commit/f7988538b2208c55f2c40ce4f0815901dc88049b
cvssv3.1 7.5 https://moodle.org/mod/forum/discuss.php?d=459500
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=459500
ssvc Track https://moodle.org/mod/forum/discuss.php?d=459500
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-38275
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-38275
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-38275
https://github.com/moodle/moodle
https://github.com/moodle/moodle/commit/0df3c5837a592e6663c4d531ff6a1f776bc2f785
https://github.com/moodle/moodle/commit/3e38c84315a7991ce5ef5f241f5e873b5ca24f01
https://github.com/moodle/moodle/commit/836b2c23a210317d130017d77bb64e3b510869a9
https://github.com/moodle/moodle/commit/f7988538b2208c55f2c40ce4f0815901dc88049b
https://moodle.org/mod/forum/discuss.php?d=459500
https://nvd.nist.gov/vuln/detail/CVE-2024-38275
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
cpe:2.3:a:moodle:moodle:4.4.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:moodle:moodle:4.4.0:*:*:*:*:*:*:*
GHSA-p2cj-86v4-7782 https://github.com/advisories/GHSA-p2cj-86v4-7782
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle/commit/0df3c5837a592e6663c4d531ff6a1f776bc2f785
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle/commit/3e38c84315a7991ce5ef5f241f5e873b5ca24f01
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle/commit/836b2c23a210317d130017d77bb64e3b510869a9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle/commit/f7988538b2208c55f2c40ce4f0815901dc88049b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=459500
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-07-02T13:36:09Z/ Found at https://moodle.org/mod/forum/discuss.php?d=459500
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-38275
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.43488
EPSS Score 0.00208
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:11:02.013030+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-p2cj-86v4-7782/GHSA-p2cj-86v4-7782.json 36.1.3