-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe key vulnerability existed in the unzip handling logic shown in commit 9ba1423. The patch added quota checks and size tracking variables ($areamaxbytes, $totalsizebytes) during extraction. The original code (before this patch) did not validate: 1) whether individual decompressed files exceeded their declared size in ZIP headers, or 2) whether the total extraction size exceeded user quotas. This allowed zip bombs or oversized extractions to consume resources unchecked. The function's loop structure (while (!feof)) without incremental size validation prior to the patch matches the CWE-400/CWE-770 description of uncontrolled resource consumption.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.3.0, < 4.3.3 | 4.3.3 |
| moodle/moodle | composer | >= 4.2.0, < 4.2.6 | 4.2.6 |
| moodle/moodle | composer | < 4.1.9 | 4.1.9 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report