GHSA-xfv7-h2qg-rjm7MediumCVSS 5.4

Moodle Lesson activity password bypass through PHP loose comparison

Published
November 20, 2024
Last Modified
November 20, 2024

🔗 CVE IDs covered (1)

CVE-2024-45691 →

📋 Description

A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values.

🎯 Affected products4

  • composer/moodle/moodle:< 4.1.13
  • composer/moodle/moodle:>= 4.2.0-beta, < 4.2.10
  • composer/moodle/moodle:>= 4.3.0-beta, < 4.3.7
  • composer/moodle/moodle:>= 4.4.0-beta, < 4.4.3

🔗 References (6)