-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from insufficient group-based authorization checks in Moodle's rating component. The patch introduced a new callback (mod_x_rating_can_see_item_ratings) to enforce group visibility. Prior to the fix, the rating system's core functions (e.g., core_rating_external::get_item_ratings and rating/index.php) only checked the 'moodle/rating:view' capability without invoking module-specific group checks. This omission allowed authenticated users to view ratings across groups. The vulnerable functions are identified in the rating component's authorization pathways where the group checks were missing.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.7.10 | 2.7.10 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.8 | 2.8.8 |
| moodle/moodle | composer | >= 2.9.0, < 2.9.2 | 2.9.2 |
A Semantic Attack on Google Gemini - Read the Latest Research