-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises because the affected PHP scripts (overview.php and view.php) lacked a critical capability check. The commit explicitly adds require_capability('moodle/badges:viewbadges', $context) to overview.php, confirming its role. While the provided diff does not include view.php, the CVE/GHSA descriptions explicitly name both files as attack vectors. The absence of the capability check in these entry points allowed unauthorized access to badge information. Confidence is high for overview.php (directly patched) and medium for view.php (implied by advisory but no patch shown).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | <= 2.6.11 | |
| moodle/moodle | composer | >= 2.7.0, < 2.7.11 | 2.7.11 |
| moodle/moodle |
| composer |
| >= 2.8.0, < 2.8.9 |
| 2.8.9 |
| moodle/moodle | composer | >= 2.9.0, < 2.9.3 | 2.9.3 |