GHSA-8g5h-gjwq-w5ch

Suggest an improvement
Source
https://github.com/advisories/GHSA-8g5h-gjwq-w5ch
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-8g5h-gjwq-w5ch/GHSA-8g5h-gjwq-w5ch.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-8g5h-gjwq-w5ch
Aliases
  • CVE-2024-34007
Published
2024-05-31T21:30:55Z
Modified
2024-12-01T05:31:36.136525Z
Summary
Moodle Logout CSRF in admin/tool/mfa/auth.php
Details

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

Database specific
{
    "nvd_published_at": "2024-05-31T21:15:09Z",
    "cwe_ids": [
        "CWE-352"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-04T17:34:49Z"
}
References

Affected packages

Packagist / moodle/moodle

Package

Name
moodle/moodle
Purl
pkg:composer/moodle/moodle

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3.0
Fixed
4.3.4

Affected versions

v4.*

v4.3.0
v4.3.1
v4.3.2
v4.3.3