-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe patch added a critical check in choice_get_availability_status to verify if a user already had a saved response (via $DB->get_records) and whether updates were allowed. In vulnerable versions, this check was absent, meaning the system didn't properly enforce the 'closed' state restrictions. The function's return value ($available) was used to control access to submission/deletion actions in view.php. Without this check, authenticated users could manipulate URLs to submit/delete responses even after the choice period ended.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 2.7.11 | 2.7.11 |
| moodle/moodle | composer | >= 2.8.0, < 2.8.9 | 2.8.9 |
| moodle/moodle | composer | >= 2.9.0, < 2.9.3 | 2.9.3 |