CVE-2024-34009 - Vulnerability Details - OpenCVE

Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Moodle	Moodle

No data.

No data.

References

Link	Providers
https://moodle.org/mod/forum/discuss.php?d=458398

History

No history.

MITRE

Status: PUBLISHED

Assigner: fedora

Published: 2024-05-31T20:49:05.538Z

Updated: 2024-08-02T02:42:59.894Z

Reserved: 2024-04-29T13:02:30.267Z

Link: CVE-2024-34009

Vulnrichment

Updated: 2024-06-05T17:46:31.768Z

NVD

Status : Awaiting Analysis

Published: 2024-05-31T21:15:09.833

Modified: 2024-11-21T09:17:54.170

Link: CVE-2024-34009

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-34009", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "state": "PUBLISHED", "assignerShortName": "fedora", "dateReserved": "2024-04-29T13:02:30.267Z", "datePublished": "2024-05-31T20:49:05.538Z", "dateUpdated": "2024-08-02T02:42:59.894Z"}, "containers": {"cna": {"title": "moodle: ReCAPTCHA can be bypassed on the login page", "datePublic": "2024-05-20T09:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "type": "CWE"}]}], "affected": [{"collectionURL": "https://git.moodle.org", "packageName": "Moodle", "versions": [{"status": "affected", "version": "4.3", "lessThanOrEqual": "4.3.3", "versionType": "semver"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<pre>Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.</pre><br>"}]}], "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=458398"}], "credits": [{"lang": "en", "value": "caglaroflazoglu", "type": "finder"}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-05-31T20:49:05.538Z"}}, "adp": [{"affected": [{"vendor": "moodle", "product": "moodle", "cpes": ["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.3", "status": "affected", "lessThanOrEqual": "4.3.3", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-01T14:31:54.655618Z", "id": "CVE-2024-34009", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-01T14:32:40.175Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:42:59.894Z"}, "title": "CVE Program Container", "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=458398", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-34009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-01T14:31:54.655618Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*"], "vendor": "moodle", "product": "moodle", "versions": [{"status": "affected", "version": "4.3", "versionType": "semver", "lessThanOrEqual": "4.3.3"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-05T17:46:31.768Z"}}], "cna": {"title": "moodle: ReCAPTCHA can be bypassed on the login page", "credits": [{"lang": "en", "type": "finder", "value": "caglaroflazoglu"}], "affected": [{"versions": [{"status": "affected", "version": "4.3", "versionType": "semver", "lessThanOrEqual": "4.3.3"}], "packageName": "Moodle", "collectionURL": "https://git.moodle.org", "defaultStatus": "unknown"}], "datePublic": "2024-05-20T09:00:00.000Z", "references": [{"url": "https://moodle.org/mod/forum/discuss.php?d=458398"}], "descriptions": [{"lang": "en", "value": "Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.", "supportingMedia": [{"type": "text/html", "value": "<pre>Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.</pre><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "shortName": "fedora", "dateUpdated": "2024-05-31T20:49:05.538Z"}}}, "cveMetadata": {"cveId": "CVE-2024-34009", "state": "PUBLISHED", "dateUpdated": "2024-08-01T14:32:40.175Z", "dateReserved": "2024-04-29T13:02:30.267Z", "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5", "datePublished": "2024-05-31T20:49:05.538Z", "assignerShortName": "fedora"}, "dataVersion": "5.1"}