-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.7.11 | 2.7.11 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.9 | 2.8.9 |
| moodle/moodle | composer | >= 2.9.0, < 2.9.3 | 2.9.3 |
Miggo AIRoot Cause AnalysisThe patch (03b1f63) explicitly adds 'require_once($CFG->dirroot.'/mod/scorm/locallib.php');' to scorm_pluginfile() in lib.php. This inclusion is necessary to access scorm_get_availability_status() which performs date checks. Without this include, the availability check would be silently skipped, allowing access to SCORM content regardless of date restrictions. The vulnerability manifests in the file serving pathway (pluginfile), which is a common vector for content access bypasses. Other affected files (player.php, view.php) were patched to use the availability checks, but the root vulnerability stemmed from the missing include in the core file handling function.