-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.5.9 | 2.5.9 |
| moodle/moodle | composer | >= 2.6.0, < 2.6.6 | 2.6.6 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.3 | 2.7.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing 'sesskey' (CSRF token) checks in functions generating URLs for forum tracking preferences. The GitHub patch explicitly adds 'sesskey' parameters to URLs in forum.js, lib.php, and deprecatedlib.php, and enforces token validation in settracking.php. These functions were modified to include the token, confirming their prior absence was the root cause. The files index.php and settracking.php also contributed to the vulnerability but are either scripts (not functions) or enforced checks post-patch, so only the named functions above are listed.
A Semantic Attack on Google Gemini - Read the Latest Research