CVE-2024-45691: moodle — Fix

Description

A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values.

Is your site exposed to CVE-2024-45691?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions
moodle	moodle	< 4.1.13
moodle	moodle	4.2.0 — 4.2.10
moodle	moodle	4.3.0 — 4.3.7
moodle	moodle	4.4.0 — 4.4.3

References

Advisories & Patches

https://moodle.org/security/

Other References

https://bugzilla.redhat.com/show_bug.cgi?id=2309940

Frequently Asked Questions

What is CVE-2024-45691? +

A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values. It has a CVSS v3.1 base score of 5.4 (MEDIUM).

How severe is CVE-2024-45691? +

CVE-2024-45691 has a CVSS v3.1 score of 5.4 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-45691? +

CVE-2024-45691 affects products from moodle, specifically: moodle. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-45691? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-33999 9.8

The referrer URL used by MFA required additional sanitizing, rather than being used directly.

CVE-2024-38276 8.8

Incorrect CSRF token checks resulted in multiple CSRF risks.

CVE-2024-34008 8.8

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

CVE-2025-3641 8.8

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS Dropbox repository. By …

CVE-2025-3642 8.8

A flaw was found in Moodle. A remote code execution risk was identified in the Moodle LMS EQUELLA repository. By …

CVE-2024-34007 8.8

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged …

CVE-2024-45691