PT-2024-8661 · Moodle+2 · Moodle+2
Published
2024-09-10
·
Updated
2025-06-03
·
CVE-2024-45691
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Moodle (affected versions not specified)
Description
The issue is related to a flaw in the authentication procedure when handling "magic hash" passwords. This flaw can allow a remote attacker to bypass the authentication process due to a loose comparison in the password-checking logic. The problem specifically affects passwords set to "magic hash" values, potentially making them less secure or allowing them to be bypassed when restricting access to a lesson activity.
Recommendations
As a temporary workaround, consider disabling the use of "magic hash" passwords for lesson activities until a patch is available.
Restrict access to lesson activities that use password protection to minimize the risk of exploitation.
Avoid using the
password variable in the affected API endpoint until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Improper Authorization
Improper Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Moodle
Red Os