-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper type handling during external database authentication. PHP's type juggling in comparisons can cause '0e1234' (hash) == 0 (integer input) to evaluate as true. The auth/db/auth.php's user_login method would be responsible for fetching and comparing external DB credentials, making it the most likely location for this vulnerability. While direct commit references aren't available, the CWE-287 context and Moodle's authentication architecture strongly support this conclusion.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.9, < 3.9.10 | 3.9.10 |
| moodle/moodle | composer | >= 3.10, < 3.10.7 | 3.10.7 |
| moodle/moodle | composer |
| >= 3.11, < 3.11.3 |
| 3.11.3 |
Ongoing coverage of React2Shell