-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from two key functions in enrol/locallib.php that prepared user data for display. Before the patch: 1) get_other_users_for_display directly included email in user details without capability checks. 2) get_users_for_display included lastaccess/groups without hidden field validation. The patch introduced prepare_user_for_display and added capability checks in UI rendering (otherusers.php/users.php), but the core vulnerability existed in these data preparation functions' lack of access control. The functions' direct inclusion of sensitive fields in their array outputs, without considering hiddenfield configurations or capabilities, made them the root cause.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 2.1, < 2.1.6 | 2.1.6 |
| moodle/moodle | composer | >= 2.2, < 2.2.3 | 2.2.3 |
A Semantic Attack on Google Gemini - Read the Latest Research