-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from multiple instances where user-controlled input (filenames/descriptions/error messages) was inserted into the DOM without proper HTML escaping. The patch consistently adds Y.Escape.html() wrappers around setContent() calls and return values in these functions. Key indicators include: 1) Direct use of node.title/shorttitle/description in display functions without escaping, 2) Unescaped msg parameter in message dialogs, and 3) Raw error text rendering. The filesystem and Google Drive repositories were specifically called out as attack vectors in advisories, aligning with these filename handling functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 2.2.0, < 2.2.8 | 2.2.8 |
| moodle/moodle | composer | >= 2.3.0, < 2.3.5 | 2.3.5 |
| moodle/moodle | composer | >= 2.4.0, < 2.4.2 | 2.4.2 |
| moodle/moodle | composer | >= 2.0.0, <= 2.1.10 |