-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing capability checks when configuring the text editor's file management options. The commit diff shows the fix added a capability check in mod/wiki/pagelib.php's constructor to conditionally enable the 'enable_filemanagement' option. In vulnerable versions, this check was absent, causing the editor to display the 'managefiles' button regardless of user permissions. The root cause is the insecure initialization of editor options in the page_wiki_edit class constructor.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 2.7.0, < 2.7.10 | 2.7.10 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.8 | 2.8.8 |
| moodle/moodle | composer | >= 2.9.0, < 2.9.2 | 2.9.2 |