Skip to content
OpenAdvisories
Medium · 5.4 CVE-2024-38277 BIT-moodle-2024-38277EUVD-2024-2156GHSA-r82w-3phg-qvr4

moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys

Published Jun 18, 2024 · Updated Feb 13, 2025 · Assigned by fedora

Vendor: Moodle Product: moodle Package: moodle/moodle Category: Web / CMS Ecosystem: Packagist

Description

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.

Affected products

VendorProductAffectedFixed
Moodle Moodle 4.4, 4.3 – ≤ 4.3.4, 4.2 – ≤ 4.2.7, 4.1 – ≤ 4.1.10 —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist moodle/moodle >= 4.4.0-beta, < 4.4.1 4.4.1 GHSA-r82w-3phg-qvr4
Packagist moodle/moodle >= 4.3.0-beta, < 4.3.5 4.3.5 GHSA-r82w-3phg-qvr4
Packagist moodle/moodle >= 4.2.0-beta, < 4.2.8 4.2.8 GHSA-r82w-3phg-qvr4
Packagist moodle/moodle < 4.1.11 4.1.11 GHSA-r82w-3phg-qvr4

Advisories 1

References