-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.11, < 3.11.9 | 3.11.9 |
| moodle/moodle | composer | >= 4.0, < 4.0.3 | 4.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing CSRF protections in H5P library management operations. Moodle uses 'sesskey' tokens for CSRF protection, and the advisory explicitly states this was missing. The affected functionality would reside in the H5P admin tool's controller and form handlers, which manage library states. These components would process enable/disable actions without proper token validation in vulnerable versions. The high confidence comes from: 1) The vulnerability's nature (state modification without CSRF checks), 2) Moodle's standard CSRF pattern using 'require_sesskey()', and 3) The H5P library management context described in references.