-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.1, < 3.1.12 | 3.1.12 |
| moodle/moodle | composer | >= 3.2, < 3.2.9 | 3.2.9 |
| moodle/moodle | composer | >= 3.3, < 3.3.6 | 3.3.6 |
| moodle/moodle | composer | >= 3.4, < 3.4.3 | 3.4.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper privilege management in portfolio export functionality. The advisory explicitly references the portfolio assignment caller class (MDL-62210) and describes URL manipulation to access unauthorized files. The prepare_package method is responsible for preparing submission files for portfolio export. If this method fails to validate() whether the requested files belong to the user's submission context, it would enable the described vulnerability. This aligns with the CWE-269 classification and the attack pattern described (modifying download URLs to access unauthorized resources).