CVE-2024-34009: Moodle ReCAPTCHA Bypass on Login Page
Summary
CVE-2024-34009: Moodle ReCAPTCHA can be bypassed on the login page. Affects moodle/moodle versions >= 4.3.0, < 4.3.4. Fixed in 4.3.4. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-34009 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system (LMS) used by educational institutions to create and manage online courses. It provides a range of features for course administration, content creation, and student engagement. The Moodle package, available on Packagist, is a popular choice for setting up LMS platforms. However, a vulnerability has been identified in the ReCAPTCHA implementation on the login page of Moodle.
Vulnerability Detail
The vulnerability in Moodle ReCAPTCHA allows for bypassing the checks on the login page. Insufficient checks were performed to verify whether ReCAPTCHA was enabled, enabling attackers to bypass the protection mechanism. This vulnerability only affects the login page and does not impact other pages where ReCAPTCHA is utilized. Exploiting this vulnerability could potentially allow unauthorized access to Moodle accounts.
How To Fix
Minimum fixed version
4.3.4
This is the first release that contains the fix.
composer require moodle/moodle:4.3.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to apply the fix by updating the Moodle package to the latest version.
Conclusion
The vulnerability in Moodle ReCAPTCHA on the login page can be bypassed, potentially leading to unauthorized access to Moodle accounts. It is crucial to update the Moodle package to version 4.3.4 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
ReCAPTCHA is a security measure used to verify that a user is human and not a bot.
Moodle version 4.3.0 is affected by this vulnerability.
No, this vulnerability only affects the login page where ReCAPTCHA is implemented.
Exploiting this vulnerability could allow unauthorized access to Moodle accounts.
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
