-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.7.10 | 2.7.10 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.8 | 2.8.8 |
| moodle/moodle | composer | >= 2.9.0, < 2.9.2 | 2.9.2 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly states that random_string and complex_random_string in lib/moodlelib.php used mt_rand(), a non-cryptographic PRNG. The commit diff confirms these functions were patched to replace mt_rand() with random_bytes_emulate(), and the CVE/NVD/GHSA references all attribute the weakness to this implementation. The functions' direct role in token generation and their dependency on mt_rand() make them the clear vulnerable points.