-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | >= 4.4.0, < 4.4.2 | 4.4.2 |
| moodle/moodle | composer | >= 4.3.0, < 4.3.6 | 4.3.6 |
| moodle/moodle | composer | >= 4.2.0, < 4.2.9 | 4.2.9 |
| moodle/moodle | composer | < 4.1.12 | 4.1.12 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stems from missing capability checks during glossary restoration. The commit MDL-64984 specifically addresses adding a capability check in mod_glossary's restore logic. The restore_glossary_activity_task::execute function is responsible for restoration setup, and prior to the fix, it didn't validate if the user had global glossary management permissions. This matches the CVE description of insufficient checks allowing unauthorized global glossary restorations. The file path and function are derived from standard Moodle module structure and the commit's context.
Ongoing coverage of React2Shell