Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page.
    This did not affect other pages where ReCAPTCHA is utilized. (CVE-2024-34009)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Moodle install hosted on the remote host is 4.3.x prior to 4.3.4. It is, therefore, affected by multiple vulnerabilities.

- Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilised.

- The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

- The referrer URL used by MFA required additional sanitizing, rather than being used directly.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page.
    This did not affect other pages where ReCAPTCHA is utilized. (CVE-2024-34009)

ID	Name	Product	Family	Type	Severity
261496	Linux Distros Unpatched Vulnerability : CVE-2024-34009	Nessus	Misc.	Local	high
114725	Moodle 4.3.x < 4.3.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
415343	SCA: security update for moodle/moodle (GHSA-gwf6-q6c2-94p3)	Tenable Cloud Security	SCA Checks	Local	high
415343	SCA: security update for moodle/moodle (GHSA-gwf6-q6c2-94p3)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-34009

high

Tenable Plugins

high

high

high

high