-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.1.0, < 4.1.2 | 4.1.2 |
| moodle/moodle | composer | >= 4.0.0, < 4.0.7 | 4.0.7 |
| moodle/moodle | composer | >= 3.11.0, < 3.11.13 | 3.11.13 |
| moodle/moodle | composer | < 3.9.20 | 3.9.20 |
Miggo AIRoot Cause AnalysisThe vulnerability arises in the filter_algebra::filter function when handling errors caused by missing binaries. The commit diff shows a critical change in how error messages are constructed. Originally, the code replaced problematic algebra syntax with a static error message (<b>Undetermined error:</b> ), discarding the original input. However, the vulnerability description indicates that unprocessed user input (algebra syntax) could still be reflected in outputs when the filter failed. The patch fixes this by appending the original input ($matches[0][$i]) to the error message, implying that prior to this fix, the input was either not properly escaped or left in the output stream under failure conditions, allowing XSS payloads in the algebra syntax to execute.
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report