-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.9, < 3.9.11 | 3.9.11 |
| moodle/moodle | composer | >= 3.10, < 3.10.8 | 3.10.8 |
| moodle/moodle | composer | >= 3.11, < 3.11.4 | 3.11.4 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions insufficient capability checks in calendar action event fetching via web services. Moodle's calendar web service endpoints are typically implemented in externallib.php files. The function name follows Moodle's pattern for web service implementations (core_[module]_external class methods). The IDOR occurs because the function likely accepted user IDs as parameters without verifying the requester's right to access those resources, matching CWE-668's exposure of resources to unauthorized spheres. The high confidence comes from the vulnerability context matching standard Moodle architecture and the specific mention of calendar action events in web services.
Ongoing coverage of React2Shell