CVE-2024-34007 moodle: logout CSRF in admin/tool/mfa/auth.php

2024-05-3120:40:23

CWE-352

fedora

github.com

cve-2024-34007

moodle

logout

csrf

admin

tool

mfa

auth

php

AI Score

6.8

Confidence

Low

EPSS

Percentile

9.0%

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

CNA Affected

[
  {
    "versions": [
      {
        "status": "affected",
        "version": "4.3",
        "versionType": "semver",
        "lessThanOrEqual": "4.3.3"
      }
    ],
    "packageName": "Moodle",
    "collectionURL": "https://git.moodle.org",
    "defaultStatus": "unknown"
  }
]