-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.6.7 | 2.6.7 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.4 | 2.7.4 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.2 | 2.8.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the lack of sanitization when displaying the course summary in course/pending.php. The patch replaced the direct output of $course->summary with format_text($course->summary, $course->summaryformat), which applies Moodle's context-aware sanitization based on the content format. The original code did not use a sanitization function, making the output vulnerable to XSS. While no named function is directly at fault, the omission of format_text() in the specific line of code constitutes the vulnerability.
A Semantic Attack on Google Gemini - Read the Latest Research