-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe GitHub patch shows the vulnerability was fixed by adding the s() sanitization function to $summary->user->$extrafield in mod/assign/classes/output/renderer.php. The absence of output escaping in the original code (CWE-79) made this function vulnerable. The commit message explicitly references escaping identity fields in the 'allocate marker form', and the affected code path handles user identity data display during marker allocation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.0, < 4.0.1 | 4.0.1 |
| moodle/moodle | composer | >= 3.11, < 3.11.7 | 3.11.7 |
| moodle/moodle | composer | >= 3.10, < 3.10.11 | 3.10.11 |
| moodle/moodle | composer | >= 3.9, < 3.9.14 | 3.9.14 |