-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.5.0, < 3.5.1 | 3.5.1 |
| moodle/moodle | composer | >= 3.4.0, < 3.4.4 | 3.4.4 |
| moodle/moodle | composer | >= 3.3.0, < 3.3.7 | 3.3.7 |
| moodle/moodle | composer | >= 3.2.0, < 3.2.10 | 3.2.10 |
| moodle/moodle | composer | >= 3.1.0, < 3.1.13 | 3.1.13 |
Miggo AIRoot Cause AnalysisThe GitHub patch shows critical escaping was added via s() wrapper in both format_question_text functions. These functions process question text for previews but lacked output sanitization before the fix, directly enabling the XSS vulnerability described. The CWE-20 mapping confirms improper input validation through missing output encoding.