-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.5.9 | 2.5.9 |
| moodle/moodle | composer | >= 2.6.0, < 2.6.6 | 2.6.6 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.3 | 2.7.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the lack of a capability check in tag_autocomplete.php. The original code only checked general authentication (require_login) but omitted require_capability('moodle/tag:edit'), allowing unauthorized tag additions. The commit diff shows the addition of this capability check and other security hardening (e.g., input validation via PARAM_TAG). The primary vulnerable code path is the procedural flow in tag_autocomplete.php, which handled the AJAX request without proper authorization. No specific named functions are directly vulnerable, but the script's entry point is the critical point of failure.
Ongoing coverage of React2Shell