-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.6, < 3.6.4 | 3.6.4 |
| moodle/moodle | composer | >= 3.5, < 3.5.6 | 3.5.6 |
| moodle/moodle | composer | >= 3.4, < 3.4.9 | 3.4.9 |
| moodle/moodle | composer | >= 3.1, < 3.1.18 | 3.1.18 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper quota validation during email attachment processing. Moodle's email message handler (message_output_email) handles incoming mail attachments and stores them in private files. The affected versions lacked a quota check in the attachment processing flow. The handler::process_attachments function is the logical point where files would be saved to private storage without proper quota validation, as the advisory explicitly mentions the email processing path as the vulnerable mechanism. The CWE-20 (Input Validation) classification aligns with missing quota checks during file ingestion.