-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in the Recent Activity block implementation. The key vulnerable function is wiki_print_recent_activity in mod/wiki/lib.php. The original implementation (pre-patch) lacked proper subwiki visibility checks when querying wiki pages for recent activity. The SQL query selected all wiki pages without validating if the current user had access rights to each subwiki. The patch introduced a subwiki visibility check using wiki_user_can_view for each entry, indicating the previous lack of proper access validation. This allowed authenticated students to see other users' wiki activity through the Recent Activity block, bypassing access controls.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.4.9 | 2.4.9 |
| moodle/moodle | composer | >= 2.5.0, < 2.5.5 | 2.5.5 |
| moodle/moodle | composer | >= 2.6.0, < 2.6.2 | 2.6.2 |