Moodle

CVE-2022-35650

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 53.65 % · centile 99 (2026-10-29)
État: PUBLISHED
Publiée: 2022-07-25 15:29 UTC
Mise à jour: 2024-08-03 09:36 UTC
Attribuée par: fedora
Statut NVD: Modified

Rechercher sur…

Description

The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.

Faiblesses (CWE)

CWE-22 — Traversée de répertoire
CWE-20 — Validation d'entrée incorrecte

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	NVD · nvd@nist.gov (Primary)

Avis

GHSA-pgm5-cr62-prxq — Moodle Arbitrary file read when importing lesson questions

Références européennes

ENISA EUVD · EUVD-2022-6384
GCVE · GCVE-0-2022-35650

Avis du CERT-FR

CERTFR-2022-AVI-653 — Multiples vulnérabilités dans Moodle · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* ≥ 3.9.0 < 3.9.15
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* ≥ 3.11.0 < 3.11.8
cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:* ≥ 4.0.0 < 4.0.2
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Produits affectés

Produit	Versions
Moodle	affected Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Moodle