The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently     being logged out via CSRF. (CVE-2024-34007)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Moodle install hosted on the remote host is 4.3.x prior to 4.3.4. It is, therefore, affected by multiple vulnerabilities.

- Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilised.

- The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

- The referrer URL used by MFA required additional sanitizing, rather than being used directly.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently
    being logged out via CSRF. (CVE-2024-34007)

ID	Name	Product	Family	Type	Severity
261493	Linux Distros Unpatched Vulnerability : CVE-2024-34007	Nessus	Misc.	Local	high
114725	Moodle 4.3.x < 4.3.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
412651	SCA: security update for moodle/moodle (GHSA-8g5h-gjwq-w5ch)	Tenable Cloud Security	SCA Checks	Local	high
412651	SCA: security update for moodle/moodle (GHSA-8g5h-gjwq-w5ch)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-34007

high

Tenable Plugins

high

high

high

high