A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Moodle | Moodle | * | 4.1.12 (excluding) |
| Moodle | Moodle | 4.2.0 (including) | 4.2.9 (excluding) |
| Moodle | Moodle | 4.3.0 (including) | 4.3.6 (excluding) |
| Moodle | Moodle | 4.4.0 (including) | 4.4.2 (excluding) |