CVE-2024-45691: Moodle: lesson activity password bypass through php loose comparison
A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values.
Other sources
When restricting access to a Lesson activity with a password, certain passwords could be bypassed/less secure due to a loose comparison in the password checking logic. (Note: this only affected passwords that are set to "magic hash" values. These are certain values where a loose comparison in the code can result in multiple values "matching" the password, instead of the expected behaviour that only an exact match for the password will be accepted).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-45691?
CVE-2024-45691 has been classified as a medium severity vulnerability due to the potential bypass of password restrictions.
How do I fix CVE-2024-45691?
To fix CVE-2024-45691, update Moodle to version 4.4.3, 4.3.7, 4.2.10, or 4.1.13.
What versions of Moodle are affected by CVE-2024-45691?
CVE-2024-45691 affects Moodle versions below 4.4.3, 4.3.7, 4.2.10, and 4.1.13.
What impact does CVE-2024-45691 have on Moodle's security?
The impact of CVE-2024-45691 allows attackers to bypass password restrictions on lesson activities, potentially compromising the security of content.
Is CVE-2024-45691 specific to a particular password type?
Yes, CVE-2024-45691 specifically affects passwords set to 'magic hash' values in Moodle.