Description
A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values.
Metrics
CVSS 3.1 5.4/10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NAffected software
| Vendor | Product | Versions |
|---|---|---|
| — | — | < 4.1.13; >= 4.2, < 4.2.10; >= 4.3, < 4.3.7; >= 4.4, < 4.4.3 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2309940Issue Tracking
- https://moodle.org/security/Vendor Advisory
Timeline
- Published
- Nov 20, 2024
- Last modified
- Jun 17, 2026
- NVD status
- Analyzed