Moodle Logout CSRF in admin/tool/mfa/auth.php · CVE-2024-34007 · GitHub Advisory Database · GitHub

Moodle Logout CSRF in admin/tool/mfa/auth.php

Moderate severity GitHub Reviewed Published May 31, 2024 to the GitHub Advisory Database • Updated Jun 4, 2024

Package

moodle/moodle (Composer)

Affected versions

>= 4.3.0, < 4.3.4

Patched versions

4.3.4

Description

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

References

Published by the National Vulnerability Database

May 31, 2024

Published to the GitHub Advisory Database May 31, 2024

Last updated Jun 4, 2024

Reviewed Jun 4, 2024