-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control during user creation in course restoration. The patch (MDL-16658) introduced restore_precheck_users to validate the 'moodle/restore:createuser' capability and added configurable checks. In vulnerable versions, restore_create_users operated without these safeguards, and restore_execute did not enforce the pre-check. The commit diff shows these functions were modified to add security checks, confirming their role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 1.8.0, < 1.8.12 | 1.8.12 |
| moodle/moodle | composer | >= 1.9.0, < 1.9.8 | 1.9.8 |