-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Mustache template helpers processing user input without adequate safeguards. The description explicitly mentions recursive rendering of user input in Mustache helpers as the root cause. Moodle's template system uses functions like those in mustache_helpers.php to handle template rendering. Functions involved in rendering user-controlled content without proper recursion limits (causing DoS) or context-aware escaping (enabling XSS) would be vulnerable. While exact function names aren't provided in advisories, the pattern 'mustache_template_helper' and core rendering functions align with the described vulnerability mechanism. The high confidence comes from the direct match between the vulnerability description and Moodle's Mustache helper architecture.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.9, < 3.9.17 | 3.9.17 |
| moodle/moodle | composer | >= 3.11, < 3.11.10 | 3.11.10 |
| moodle/moodle | composer | >= 4.0, < 4.0.4 | 4.0.4 |
Ongoing coverage of React2Shell