-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the lack of guest user checks in the iplookup/index.php script. The patch introduced require_login(0, false) and an explicit isguestuser() check, which were absent in vulnerable versions. This allowed unauthenticated/guest users to repeatedly invoke the geolocation calculation, leading to resource exhaustion. The primary issue was insufficient access control in the script's entry point, not the geolocation functions themselves.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.5.9 | 2.5.9 |
| moodle/moodle | composer | >= 2.6.0, < 2.6.6 | 2.6.6 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.3 | 2.7.3 |
A Semantic Attack on Google Gemini - Read the Latest Research