-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 3.4.8 | 3.4.8 |
| moodle/moodle | composer | >= 3.5, < 3.5.5 | 3.5.5 |
| moodle/moodle | composer | >= 3.6, < 3.6.3 | 3.6.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how OAuthRequest::from_request handled parameter merging. The original code merged $_POST parameters (with URL decoding) after parsing the Authorization header, allowing POST parameters to override signed OAuth parameters. Attackers could inject a 'roles' parameter in the POST body to escalate privileges, as the system processed these untrusted parameters without proper validation against the OAuth signature. The patch removed the POST parameter override behavior, confirming this function's role in the vulnerability.
A Semantic Attack on Google Gemini - Read the Latest Research