Separate Unique Keys for QR Login and Auto-Login
CVE-2024-38277

5.4MEDIUM

Key Information:

What is CVE-2024-38277?

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.

Moodle 4.4

Moodle 4.3 <= 4.3.4

Moodle 4.2 <= 4.2.7

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet