-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | <= 2.1.10 | |
| moodle/moodle | composer | >= 2.2.0, < 2.2.8 | 2.2.8 |
| moodle/moodle | composer | >= 2.3.0, < 2.3.5 | 2.3.5 |
| moodle/moodle | composer | >= 2.4.0, < 2.4.2 | 2.4.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from user/view.php calling require_login() to enforce authentication but failing to check if the authenticated user is a guest. The 'forceloginforprofiles' setting requires non-guest users to view profiles, but the original code did not include a check for isguestuser() after require_login(). This allowed guests (who are technically 'logged in' in Moodle's default configuration) to bypass the intended access control. The fix explicitly added an isguestuser() check and redirection, confirming that the absence of this check in the vulnerable code was the root cause.