GHSA-8g5h-gjwq-w5ch
Moodle Logout CSRF in admin/tool/mfa/auth.php
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | moodle/moodle | >= 4.3.0, < 4.3.4 | 4.3.4 |
Details
As written in the advisory (Markdown source, shown as plain text).
The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.
References
External links from the advisory. They lead to third-party sites.