GHSA-gwf6-q6c2-94p3

Moodle ReCAPTCHA can be bypassed on the login page

En bref

Publiée: 2024-05-31 21:30 UTC
Mise à jour: 2025-05-31 06:27 UTC
CVE: CVE-2024-34009
Alias: BIT-moodle-2024-34009
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.

Paquets affectés

Paquet	Versions
Packagist · moodle/moodle	introduced 4.3.0, fixed 4.3.4

Références

https://nvd.nist.gov/vuln/detail/CVE-2024-34009 ADVISORY
https://github.com/moodle/moodle PACKAGE
https://moodle.org/mod/forum/discuss.php?d=458398 WEB
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-81463 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database