-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing CSRF token validation in the registration handler. The patch adds require_sesskey() at the top of register.php and includes sesskey in registration links. In vulnerable versions, the absence of these checks meant any request to register.php could be forged without session token validation. The main script entry point in register.php is the vulnerable component as it handles the sensitive registration action without proper CSRF protection prior to the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.7.11 | 2.7.11 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.9 | 2.8.9 |
| moodle/moodle | composer | >= 2.9.0, < 2.9.3 | 2.9.3 |
A Semantic Attack on Google Gemini - Read the Latest Research