-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 4.1.18 | 4.1.18 |
| moodle/moodle | composer | >= 4.3.0-beta, < 4.3.12 | 4.3.12 |
| moodle/moodle | composer | >= 4.4.0-beta, < 4.4.8 | 4.4.8 |
| moodle/moodle | composer | >= 4.5.0-beta, < 4.5.4 | 4.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the direct use of unserialize() on base64 decoded input within several methods of the repository_equella class in repository/equella/lib.php. The patch (commit 630fbf6230ee18d63ce69bea34173fb151b599da) replaces these direct calls with a new helper method unserialize_reference, which uses unserialize_object(). This change indicates that the previous direct unserialize() calls were susceptible to PHP object injection if the input (file reference) could be controlled by an attacker. The functions get_file, sync_reference, send_file, and get_reference_details all contained this vulnerable pattern before the patch and are therefore identified as vulnerable.
Ongoing coverage of React2Shell