CVE-2024-34009: Moodle ReCAPTCHA Bypass Vulnerability on Login Page
Summary
CVE-2024-34009: moodle: ReCAPTCHA can be bypassed on the login page. Affects moodle versions >= 4.3.0, < 4.3.4. Fixed in 4.3.4. How to fix ↓
Also tracked for
- moodle/moodle · Packagist
The same CVE-2024-34009 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Moodle is an open-source learning platform designed to provide educators, administrators, and learners with a single robust, secure, and integrated system to create personalized learning environments. It includes features such as course management, user management, and various plugins to enhance functionality. However, a recent vulnerability has been identified that allows bypassing ReCAPTCHA checks specifically on the login page, potentially compromising user security.
Vulnerability Detail
The vulnerability arises from insufficient checks to determine whether ReCAPTCHA was enabled on the login page of Moodle. This oversight allows malicious users to bypass the ReCAPTCHA verification, which is intended to prevent automated login attempts and protect against brute-force attacks. While this issue does not affect other pages where ReCAPTCHA is implemented, it poses a significant risk to the integrity of user accounts on the login page, potentially leading to unauthorized access.
How To Fix
Minimum fixed version
4.3.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the ReCAPTCHA feature on the login page until the update is applied. This can be done by navigating to Site Administration > Plugins > Authentication > Manage Authentication and disabling the ReCAPTCHA plugin.
Conclusion
The CVE-2024-34009 vulnerability in Moodle poses a significant risk by allowing ReCAPTCHA bypass on the login page. It is crucial for users to update to version 4.3.4 or later to mitigate this risk. In the meantime, disabling ReCAPTCHA can serve as a temporary measure to protect user accounts.
See every vulnerability recorded for moodle →
FAQ
CVE-2024-34009 is a vulnerability in Moodle that allows attackers to bypass ReCAPTCHA checks on the login page.
This vulnerability can lead to unauthorized access to user accounts, compromising the security of your Moodle site.
The vulnerability affects Moodle versions prior to 4.3.4.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, consider disabling the ReCAPTCHA feature on the login page as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle.
