-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | <= 2.5.9 | |
| moodle/moodle | composer | >= 2.6.0, < 2.6.11 | 2.6.11 |
| moodle/moodle | composer | >= 2.7.0, < 2.7.8 | 2.7.8 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.6 | 2.8.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper validation of the HTTP Referer header. The commit patches show multiple instances where $_SERVER['HTTP_REFERER'] was used directly in redirects or stored for later use without sanitization via clean_param(PARAM_LOCALURL). The two functions identified (loginpage_hook and forum_set_return) explicitly handle the Referer header in their logic. Other vulnerable code exists in procedural scripts (e.g., course/togglecompletion.php), but they lack named functions. These two functions are high-confidence examples where the Referer was mishandled, as confirmed by the patch's addition of sanitization logic.