GitHub Advisoryadvisory · Packagist

GHSA-vjmm-r9gg-425m Moodle has arbitrary file read risk through pdfTeX

MEDIUM Published 2024-11-07 Modified 2025-02-11 Official page ↗
Aliases
CVE-2024-43426
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-1287
Reviewed
2024-11-07

Affected packages

• Packagist moodle/moodle: < 4.1.12 → fixed in 4.1.12 • Packagist moodle/moodle: >= 4.2.0-beta, < 4.2.9 → fixed in 4.2.9 • Packagist moodle/moodle: >= 4.3.0-beta, < 4.3.6 → fixed in 4.3.6 • Packagist moodle/moodle: >= 4.4.0-beta, < 4.4.2 → fixed in 4.4.2

Description

A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-1287 Improper Validation of Specified Type of Input weakness

References