Miembros de
Boletines de Vulnerabilidades |
MSA-24-0044: Lesson activity password bypass through PHP loose comparison |
|
| Software afectado | PHP |
|
par Michael Hawkins. When restricting access to a Lesson activity with a password, certain passwords could be bypassed/less secure due to a loose comparison in the password checking logic.Note: this only affected passwords that are set to "magic hash" values. These are certain values where a loose comparison in the code can result in multiple values "matching" the password, instead of the expected behaviour that only an exact match for the password will be More info: https://moodle.org/mod/forum/discuss.php?d=461897&parent=1854494 |
|
