CVE-2024-38275: 
PHP vulnerability analysis and mitigation

The cURL wrapper in Moodle contained a security vulnerability where it retained the original request headers when following redirects, potentially exposing HTTP authorization header information to unintended redirect URLs. This vulnerability was assigned CVE-2024-38275 and was discovered in June 2024. The affected versions include Moodle 4.4, 4.3 to 4.3.4, 4.2 to 4.2.7, 4.1 to 4.1.10, and earlier unsupported versions (Moodle Forum).

The vulnerability was classified with a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue stems from the cURL wrapper's behavior of preserving HTTP authorization headers during redirect operations, which could lead to unauthorized disclosure of sensitive authentication information (NVD).

The primary impact of this vulnerability is the potential exposure of sensitive authentication information. When the application follows redirects, the authorization headers could be unintentionally disclosed to third-party domains or unauthorized endpoints, potentially compromising user credentials or authentication tokens (Moodle Forum).

The vulnerability has been classified as having a 'Minor' severity risk by Moodle. The exploit requires no user interaction (UI:N) and can be accessed over the network (AV:N) with low attack complexity (AC:L) (Moodle Forum).

The vulnerability has been fixed in Moodle versions 4.4.1, 4.3.5, 4.2.8, and 4.1.11. Users are advised to upgrade to these patched versions to mitigate the risk (Moodle Forum).