-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in glossary entry deletion. Moodle's glossary module typically handles deletions via mod/glossary/lib.php functions. The key flaw was a missing context-specific capability check when processing deletions. The function mod_glossary_delete_entry would normally be responsible for validating permissions against the entry's parent glossary context. In vulnerable versions, this check was either absent or incorrectly implemented, allowing users with generic delete permissions to affect entries in unauthorized glossaries. This matches the CWE-284 (Improper Access Control) and CWE-862 (Missing Authorization) classifications provided.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.7, < 3.7.1 | 3.7.1 |
| moodle/moodle | composer | >= 3.6, < 3.6.5 | 3.6.5 |
| moodle/moodle | composer | >= 3.5, < 3.5.7 | 3.5.7 |