GHSA-vjmm-r9gg-425m
Moodle has arbitrary file read risk through pdfTeX
At a glance
- Published
- Updated
- CVE
- CVE-2024-43426
- Aliases
- BIT-moodle-2024-43426
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Description
A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
Affected packages
| Package | Versions |
|---|---|
| Packagist · moodle/moodle | introduced 0, fixed 4.1.12 |
| Packagist · moodle/moodle | introduced 4.2.0-beta, fixed 4.2.9 |
| Packagist · moodle/moodle | introduced 4.3.0-beta, fixed 4.3.6 |
| Packagist · moodle/moodle | introduced 4.4.0-beta, fixed 4.4.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-43426 ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=2304254 WEB
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82745 WEB
- https://github.com/moodle/moodle PACKAGE
- https://moodle.org/mod/forum/discuss.php?d=461194 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |