-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability involves session hijack risk in Shibboleth authentication. Session hijacking typically occurs when session identifiers aren't properly invalidated/regenerated during authentication. Moodle's Shibboleth plugin's core authentication function (auth_shibboleth_authenticate_user_login) would be responsible for session management during login. The high confidence comes from: 1) Vulnerability context matching session management flaws, 2) Shibboleth authentication flow requiring secure session handling, and 3) Common patterns where session fixation vulnerabilities occur in authentication handlers that don't regenerate session IDs.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.9, < 3.9.10 | 3.9.10 |
| moodle/moodle | composer | >= 3.10, < 3.10.7 | 3.10.7 |
| moodle/moodle | composer |
| >= 3.11, < 3.11.3 |
| 3.11.3 |
Ongoing coverage of React2Shell