-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.8, <= 3.8.2 | 3.8.3 |
| moodle/moodle | composer | >= 3.7, <= 3.7.5 | 3.7.6 |
| moodle/moodle |
Miggo AIRoot Cause AnalysisThe key vulnerability stemmed from how scorm_eval_prerequisites handled status comparisons. The original code (pre-patch) used user-controlled $matches[2] to directly set comparison operators ($oper) without validation. This allowed injection of unintended comparison logic. The patch replaced dynamic operator generation with a strict strcmp check and boolean logic, confirming the vulnerability was in operator handling. The CWE-20 (Input Validation) mapping and RCE impact further support this as the entry point.
| composer |
| >= 3.6, <= 3.6.9 |
| 3.6.10 |
| moodle/moodle | composer | >= 3.5, <= 3.5.11 | 3.5.12 |
Ongoing coverage of React2Shell