GitHub Advisoryadvisory · Packagist

GHSA-8g5h-gjwq-w5ch Moodle Logout CSRF in admin/tool/mfa/auth.php

MEDIUM Published 2024-05-31 Modified 2024-06-04 Official page ↗

Aliases: CVE-2024-34007
Ecosystem: Packagist
Packages: moodle/moodle
Severity: Moderate
Weaknesses: CWE-352
Reviewed: 2024-06-04

Affected packages

• Packagist moodle/moodle: >= 4.3.0, < 4.3.4 → fixed in 4.3.4

Description

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

Related

Alias · CVE (1)

CVE-2024-34007 The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF. vulnerability

Weakness · CWE (1)

CWE-352 Cross-Site Request Forgery weakness

References