Moodle Multi-Factor Authentication Vulnerability Leading to User Denial-of-Service and Name Disclosure

A vulnerability in Moodle's Multi-Factor Authentication (MFA) email factor can be exploited to revoke a user's only available second authentication factor. This flaw, caused by a missing check in the MFA email factor's revoke action, can prevent users from logging in, even after completing two-factor authentication. Additionally, the vulnerability allows for the disclosure of the user's name through an Insecure Direct Object Reference (IDOR) exploitation. The issue affects Moodle versions 4.5 prior to 4.5.4, 4.4 prior to 4.4.8, and 4.3 prior to 4.3.12.

Impact

Exploitation of this vulnerability causes a denial-of-service condition for users by disrupting their login process, despite having completed two-factor authentication. It also leads to unauthorized disclosure of user names.

Remediation

Users can upgrade to Moodle versions 4.5.4, 4.4.8, or 4.3.12 to address this vulnerability.