CVE-2024-34009: moodle: ReCAPTCHA can be bypassed on the login page
Published May 31, 2024
·Updated
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.
Affected Software
2 affected componentsFixes available
composer/moodle/moodle>=4.3.0<4.3.4
4.3.4
Moodle moodle>=4.3.0<4.3.4
Event History
May 31, 2024
CVE Published
via MITRE·08:49 PM
Data Sourced
via MITRE·08:49 PM
DescriptionWeakness
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 PM
Affected Software
Advisory Published
via GitHub·09:30 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-34009?
CVE-2024-34009 is classified as a medium severity vulnerability.
2
How do I fix CVE-2024-34009?
To fix CVE-2024-34009, ensure that you are using Moodle version 4.3.4 or later, where ReCAPTCHA checks have been corrected.
3
What is the impact of CVE-2024-34009?
CVE-2024-34009 allows attackers to bypass ReCAPTCHA checks on the login page, potentially enabling unauthorized access.
4
Which versions of Moodle are affected by CVE-2024-34009?
CVE-2024-34009 affects Moodle versions between 4.3.0 and 4.3.4.
5
Is CVE-2024-34009 specific to certain pages in Moodle?
Yes, CVE-2024-34009 specifically affects the login page where ReCAPTCHA checks can be bypassed.