GHSA-gwf6-q6c2-94p3

Moodle ReCAPTCHA can be bypassed on the login page

At a glance

Published: 2024-05-31 21:30 UTC
Updated: 2025-05-31 06:27 UTC
CVE: CVE-2024-34009
Aliases: BIT-moodle-2024-34009
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Description

Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.

Affected packages

Package	Versions
Packagist · moodle/moodle	introduced 4.3.0, fixed 4.3.4

References

https://nvd.nist.gov/vuln/detail/CVE-2024-34009 ADVISORY
https://github.com/moodle/moodle PACKAGE
https://moodle.org/mod/forum/discuss.php?d=458398 WEB
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-81463 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database