-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.0.0, < 4.0.3 | 4.0.3 |
| moodle/moodle | composer | >= 3.11.0, < 3.11.9 | 3.11.9 |
| moodle/moodle | composer | < 3.9.16 | 3.9.16 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) The check_page_access function's original logic in attemptlib.php only blocked backward navigation in sequential mode but didn't enforce 'current page + 1' limitations, allowing forward skips. 2) The get_attempt_questions_data in external.php exposed questions through web services without proper sequence validation. The patch added check_page_access validation with strict allownext=false parameter in external.php and revamped the check_page_access logic to implement proper sequential constraints, confirming these were the vulnerable points.
Ongoing coverage of React2Shell