-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| moodle/moodle | composer | < 4.1.18 | 4.1.18 |
| moodle/moodle | composer | >= 4.3.0-beta, < 4.3.12 | 4.3.12 |
| moodle/moodle | composer | >= 4.4.0-beta, < 4.4.8 | 4.4.8 |
| moodle/moodle | composer | >= 4.5.0-beta, < 4.5.4 | 4.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability description points to an IDOR in a messaging web service due to insufficient capability checks. The provided commits all modify the message/externallib.php file, specifically the get_member_info static method within the core_message_external class.
Commit a8179842b450659c288f284e06361a4fbab8742a is the primary security patch. It introduces a filtering mechanism for the userids parameter by checking user_can_view_profile for each requested user. Before this change, the userids were passed directly to \core_message\helper::get_member_info without adequate permission checks, leading to the IDOR.
The subsequent commits (2fd810c8981f9b10087467a3b8fce779b157200f and bb65effe41524d8373c1dc499c3323ac469ea558) refine this logic (e.g., by checking for existing contacts or adding early exits for empty arrays), but the core vulnerability was addressed by the initial filtering introduced in a8179842b450659c288f284e06361a4fbab8742a. Therefore, core_message_external::get_member_info is the function that was processing potentially malicious input (the userids parameter) without proper authorization checks.