-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing CSRF protections in two key areas: 1) The PHP action handlers in editcategories.php didn't call require_sesskey() before executing state-changing operations (edit/delete/add categories). 2) The HTML form in editcategories.html didn't include a sesskey parameter in its submission. The patch added both sesskey hidden fields in the form and require_sesskey() checks in the PHP logic, confirming these were the vulnerable points. CSRF vulnerabilities manifest when state-changing actions lack token validation, which matches the pre-patch behavior observed in these components.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.6.7 | 2.6.7 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.4 | 2.7.4 |
| moodle/moodle | composer |
| >= 2.8.0, < 2.8.2 |
| 2.8.2 |
PHPPHPOngoing coverage of React2Shell