-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.1.0, < 4.1.2 | 4.1.2 |
| moodle/moodle | composer | >= 4.0.0, < 4.0.7 | 4.0.7 |
| moodle/moodle | composer | >= 3.11.0, < 3.11.13 | 3.11.13 |
| moodle/moodle | composer | < 3.9.20 | 3.9.20 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from two functions in page_helper.php that set the page heading using the target user's full name. The patch removed the $PAGE->set_heading(fullname($user)) calls, which were leaking names. The CWE-639 (Authorization Bypass via User-Controlled Key) indicates attackers could manipulate the userid parameter to access unauthorized pages, while CWE-200 confirms the exposure of sensitive data (names). The removal of these lines in the commit directly addresses the information leak, confirming these functions as the vulnerability source.
Ongoing coverage of React2Shell