CVE-2024-38277: Moodle uses the same key for QR login and auto-login
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
Other sources
Moodle uses the same key for QR login and auto-login
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.2.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38277?
CVE-2024-38277 has a moderate severity level due to potential security implications from key interchangeability.
How do I fix CVE-2024-38277?
To fix CVE-2024-38277, upgrade to Moodle versions 4.1.11, 4.2.8, 4.3.5, or 4.4.1 or later.
What software is affected by CVE-2024-38277?
CVE-2024-38277 affects Moodle versions before 4.1.11, 4.2.0-beta to 4.2.8, 4.3.0-beta to 4.3.5, and 4.4.0-beta to 4.4.1.
What is the impact of CVE-2024-38277?
The impact of CVE-2024-38277 may allow an attacker to exploit the same key for both QR login and auto-login, compromising user accounts.
When was CVE-2024-38277 disclosed?
CVE-2024-38277 was disclosed in 2024 but the exact date of disclosure is not stated in the information provided.