moodle/moodle · Security
Moodle has arbitrary file read risk through pdfTeX
- GHSA ID
- GHSA-vjmm-r9gg-425m
- CVE ID
- CVE-2024-43426
- Severity
- medium
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v4
- 6.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Description
A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
CWEs
- CWE-1287 · Improper Validation of Specified Type of Input