CVE-2024-34007: Moodle Logout CSRF in admin/tool/mfa/auth.php
Summary
CVE-2024-34007: Moodle Logout CSRF in admin/tool/mfa/auth.php. Affects moodle/moodle versions >= 4.3.0, < 4.3.4. Fixed in 4.3.4. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-34007 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses. It provides a wide range of features for educators and learners, including course management, content creation, and communication tools. The vulnerability affects the Moodle package, specifically the admin/tool/mfa/auth.php file.
Vulnerability Detail
The logout option within Moodle's multi-factor authentication (MFA) feature did not include the necessary token to prevent users from being inadvertently logged out via Cross-Site Request Forgery (CSRF) attacks. This vulnerability could allow an attacker to trick a logged-in user into unknowingly triggering a logout action, leading to potential disruption of their session and loss of unsaved work.
How To Fix
Minimum fixed version
4.3.4
This is the first release that contains the fix.
composer require moodle/moodle:4.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The Moodle package is vulnerable to a CSRF attack in the admin/tool/mfa/auth.php file, which could lead to unintended logouts for users. To mitigate this vulnerability, it is crucial to update to Moodle version 4.3.4 or later. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system (LMS) used for creating and delivering online courses.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request, unknowingly performing unwanted actions on their behalf.
This vulnerability could allow an attacker to log out Moodle users without their knowledge or consent, potentially disrupting their session and causing loss of unsaved work.
To fix this vulnerability, update the Moodle package to version 4.3.4 or later, which includes the necessary token to prevent CSRF attacks during the logout process.
For more information about upgrading Moodle, refer to the official upgrade instructions provided by the Moodle project.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
