Miembros de
Boletines de Vulnerabilidades |
MSA-25-0017: Self enrolment available before completing second factor with MFA enabled |
|
| Software afectado | PHP |
|
par Michael Hawkins. On sites with Multi-Factor Authentication enabled, it was possible to use course self enrolment after passing only the first login factor (such as passing a username/password check). The user should also have to pass a second login factor before gaining access to self enrolment.Severity/Risk:MinorVersions affected:4.5 to 4.5.3, 4.4 to 4.4.7 and 4.3 to 4.3.11Versions fixed:4.5.4, 4.4.8 and 4.3.12Reported by:Guillaume BaratCVE identifier:CVE-2025-3634Changes More info: https://moodle.org/mod/forum/discuss.php?d=467596&parent=1877215 |
|
