-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 2.7.0, < 2.7.3 | 2.7.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the get_grades function in grades_external.php not enforcing the 'moodle/grade:viewhidden' capability prior to the patch. The commit explicitly adds this check via require_capability('moodle/grade:viewhidden'), and the CVE description specifically references this function's web service endpoint as the exposure vector. The test case modifications also demonstrate how student access was improperly allowed before the capability check was added. No other functions in the diff are directly involved in the authorization logic for grade visibility.