-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.4.0-beta, < 4.4.1 | 4.4.1 |
| moodle/moodle | composer | >= 4.3.0-beta, < 4.3.5 | 4.3.5 |
| moodle/moodle | composer | >= 4.2.0-beta, < 4.2.8 | 4.2.8 |
| moodle/moodle | composer | < 4.1.11 | 4.1.11 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from insufficient output escaping when displaying calendar event titles in the deletion confirmation prompt. Moodle's calendar event deletion flow would involve functions that handle event data retrieval and confirmation dialog rendering. The functions listed are common points where unescaped user-controlled data (event title) would be injected into HTML responses. While exact code isn't available, Moodle's architecture patterns and the XSS nature of the vulnerability strongly suggest these components as the vulnerable points.
A Semantic Attack on Google Gemini - Read the Latest Research