-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 1.9.14 | 1.9.14 |
| moodle/moodle | composer | >= 2.0, < 2.0.5 | 2.0.5 |
| moodle/moodle | composer | >= 2.1, < 2.1.2 | 2.1.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the MoodleQuickForm class not properly handling 'setConstant' operations. The patch adds a critical check for _constantValues in exportValues() and merges them into the form data. This indicates the original implementation lacked this merge step, allowing constant fields to be modified by clients. The function exportValues() is directly modified in the fix, confirming its role in the vulnerability. The CWE-471 (MAID) classification further supports this, as the flaw involved modifying assumed-immutable data via missing constant enforcement.