CVE-2024-34009: Moodle ReCAPTCHA can be bypassed on the login page

May 31, 2024 (updated June 4, 2024)

Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.

References

github.com/advisories/GHSA-gwf6-q6c2-94p3
github.com/moodle/moodle
moodle.org/mod/forum/discuss.php?d=458398
nvd.nist.gov/vuln/detail/CVE-2024-34009

Code Behaviors & Features

Detect and mitigate CVE-2024-34009 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →