CVE-2024-34007: moodle: logout CSRF in admin/tool/mfa/auth.php
Published May 31, 2024
·Updated
The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.
Affected Software
2 affected componentsFixes available
composer/moodle/moodle>=4.3.0<4.3.4
4.3.4
Moodle moodle>=4.3.0<4.3.4
Event History
May 31, 2024
CVE Published
via MITRE·08:40 PM
Data Sourced
via MITRE·08:40 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
SeverityAffected Software
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-34007?
CVE-2024-34007 has a medium severity level due to the risk of Cross-Site Request Forgery (CSRF) that could lead to inadvertent logout of users.
2
How do I fix CVE-2024-34007?
To fix CVE-2024-34007, upgrade Moodle to version 4.3.4 or later, which includes the required CSRF protection for the logout option.
3
What versions of Moodle are affected by CVE-2024-34007?
CVE-2024-34007 affects Moodle versions from 4.3.0 to 4.3.4.
4
What issue does CVE-2024-34007 address?
CVE-2024-34007 addresses the lack of CSRF token in the logout option within Multi-Factor Authentication (MFA), creating a risk for unintended logouts.
5
Is there a workaround for CVE-2024-34007?
There is no recommended workaround for CVE-2024-34007; applying the patch by upgrading to version 4.3.4 is the best solution.