-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper access control in the 'loginas' functionality. Moodle's user impersonation system allowed users with course-level 'loginas' capability to switch to site administrators because the function did not enforce context boundaries between course roles and system-wide roles. The fix (referenced in MDL-68974) likely added context hierarchy validation to prevent privilege escalation. The core session manager's loginas function is the logical point where this authorization check would occur, making it the most probable vulnerable component.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.9, <= 3.9.1 | 3.9.2 |
| moodle/moodle | composer | >= 3.8, <= 3.8.4 | 3.8.5 |
| moodle/moodle | composer | >= 3.7, <= 3.7.7 | 3.7.8 |
| moodle/moodle | composer | >= 3.5, <= 3.5.13 | 3.5.14 |
PHPPHPOngoing coverage of React2Shell