-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability specifically affects 'social' user profile fields where insufficient sanitization occurred. Moodle's profile field types are implemented as classes in the user/profile/field/ directory. The social field type (profile_field_social) would handle display logic in methods like display_data(). The advisory explicitly mentions insufficient escaping in these fields, and the pattern of XSS vulnerabilities in Moodle often involves missing output encoding in display methods. Though the exact commit isn't viewable, the contextual clues about social profile fields and standard Moodle architecture strongly indicate this function as the vulnerable point.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 3.11, < 3.11.11 | 3.11.11 |
| moodle/moodle | composer | >= 4.0, < 4.0.5 | 4.0.5 |
KEV Misses 88% of Exploited CVEs- Get the report