-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 2.3.0, < 2.3.7 | 2.3.7 |
| moodle/moodle | composer | >= 2.4.0, < 2.4.4 | 2.4.4 |
| moodle/moodle | composer | < 2.2.10 | 2.2.10 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the pre-patch updateSubmission method's failure to recursively process array-structured form data. The commit diff shows the vulnerable code looped through submission keys, checked _types for exact matches, and applied cleaning superficially. This left nested elements (e.g., 'foo[bar]') unvalidated if their specific keys weren't explicitly registered in _types. The patch introduced getCleanType and getCleanedValue to recursively resolve types, confirming the original function's insufficiency. The CVE description explicitly cites improper handling of array-element syntax, aligning with this code path.
A Semantic Attack on Google Gemini - Read the Latest Research