GHSA-8g5h-gjwq-w5ch

Suggest an improvement
Source
https://github.com/advisories/GHSA-8g5h-gjwq-w5ch
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-8g5h-gjwq-w5ch/GHSA-8g5h-gjwq-w5ch.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8g5h-gjwq-w5ch
Aliases
  • CVE-2024-34007
Published
2024-05-31T21:30:55Z
Modified
2024-06-04T17:57:01.435558Z
Summary
Moodle Logout CSRF in admin/tool/mfa/auth.php
Details

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

References

Affected packages

Packagist / moodle/moodle

Package

Name
moodle/moodle
Purl
pkg:composer/moodle/moodle

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3.0
Fixed
4.3.4

Affected versions

v4.*

v4.3.0
v4.3.1
v4.3.2
v4.3.3