« Volver al listado

CVE-2024-45691

Estado: AnalizadaMedia (5.4)—

A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Moodle — Moodle

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45691",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45691",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-20T19:17:16.356151Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "patrick@puiterwijk.org",
      "affectedData": [
        {
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.1.13",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.2",
              "lessThan": "4.2.10",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.3",
              "lessThan": "4.3.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.4",
              "lessThan": "4.4.3",
              "versionType": "semver"
            }
          ],
          "packageName": "moodle",
          "collectionURL": "https://github.com/moodle/moodle",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-11-20T11:15:05.490",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2309940",
      "tags": [
        "Issue Tracking"
      ],
      "source": "patrick@puiterwijk.org"
    },
    {
      "url": "https://moodle.org/security/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "patrick@puiterwijk.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to \"magic hash\" values."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en Moodle. Al restringir el acceso a una actividad de lección con una contraseña, ciertas contraseñas podían ser ignoradas o menos seguras debido a una comparación poco precisa en la lógica de verificación de contraseñas. Este problema solo afectaba a las contraseñas configuradas con valores de \"hash mágico\"."
    }
  ],
  "lastModified": "2026-06-17T07:54:40.033",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFA99B07-9756-4DF8-A807-72D175B485F8",
              "versionEndExcluding": "4.1.13"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BA66423-C6E4-4083-A957-D8DAC924FA7D",
              "versionEndExcluding": "4.2.10",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "22C8E2F5-D5D6-4309-91AB-C5AF23255D2C",
              "versionEndExcluding": "4.3.7",
              "versionStartIncluding": "4.3.0"
            },
            {
              "criteria": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CD03E57-232E-442C-B1E0-9C0974006F78",
              "versionEndExcluding": "4.4.3",
              "versionStartIncluding": "4.4.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "patrick@puiterwijk.org"
}