-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper output escaping of the 'idnumber' user field. The commit a7e0ba1 shows critical fixes: 1) In block_activity_results.php, ID numbers were concatenated into HTML without using s() for escaping. 2) In myprofilelib.php, the ID number was passed directly to the profile node without sanitization. These locations directly output user-controlled data to the page, making them vulnerable to stored XSS. The patch added proper escaping via s(), confirming these were the vulnerable points.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.10, <= 3.10.1 | 3.10.2 |
| moodle/moodle | composer | >= 3.9, <= 3.9.4 | 3.9.5 |
| moodle/moodle | composer | >= 3.8, <= 3.8.7 | 3.8.8 |
| moodle/moodle | composer | >= 3.5, <= 3.5.16 | 3.5.17 |