moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php (CVE-2024-33999)
A critical vulnerability in Moodle versions 4.3.0 through before 4.3.4 involves unsafe direct use of the HTTP_REFERER server variable in the multi-factor authentication (MFA) admin tool. The referrer URL was used without sufficient sanitization, potentially allowing security issues related to untrusted input. A patch is available to address this issue.
AI Analysis
Technical Summary
CVE-2024-33999 identifies a critical security flaw in Moodle's admin/tool/mfa/index.php where the HTTP_REFERER header is used directly without proper sanitization. This unsafe handling of the referrer URL could lead to security risks such as injection or redirection attacks. The vulnerability affects Moodle versions from 4.3.0 up to but not including 4.3.4. A fix has been made available to sanitize the referrer input properly.
Potential Impact
The vulnerability allows an attacker to exploit the unsafe use of the HTTP_REFERER header in the MFA admin tool, potentially leading to security issues such as injection or manipulation of the referrer URL. The exact impact is not detailed beyond the critical severity rating, but improper input sanitization in an authentication-related component can undermine security controls.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Moodle to version 4.3.4 or later to ensure the unsafe use of HTTP_REFERER is properly sanitized. No additional mitigation steps are indicated beyond applying the official fix.
moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php (CVE-2024-33999)
Description
A critical vulnerability in Moodle versions 4.3.0 through before 4.3.4 involves unsafe direct use of the HTTP_REFERER server variable in the multi-factor authentication (MFA) admin tool. The referrer URL was used without sufficient sanitization, potentially allowing security issues related to untrusted input. A patch is available to address this issue.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-33999 identifies a critical security flaw in Moodle's admin/tool/mfa/index.php where the HTTP_REFERER header is used directly without proper sanitization. This unsafe handling of the referrer URL could lead to security risks such as injection or redirection attacks. The vulnerability affects Moodle versions from 4.3.0 up to but not including 4.3.4. A fix has been made available to sanitize the referrer input properly.
Potential Impact
The vulnerability allows an attacker to exploit the unsafe use of the HTTP_REFERER header in the MFA admin tool, potentially leading to security issues such as injection or manipulation of the referrer URL. The exact impact is not detailed beyond the critical severity rating, but improper input sanitization in an authentication-related component can undermine security controls.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Moodle to version 4.3.4 or later to ensure the unsafe use of HTTP_REFERER is properly sanitized. No additional mitigation steps are indicated beyond applying the official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-moodle-2024-33999
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2024-33999"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Critical
Threat ID: 6aa00618acd9273b49ab77b3
Added to database: 09/08/2026, 12:56:56 UTC
Last enriched: 09/08/2026, 13:44:56 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 22
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.