by Kastro
Paper/Archive/CVE-2022-35649

CVE-2022-35649

fedora — The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code.

EPSS 9%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 95.1.951 × 2019.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected

ProductAffectedFixed inSource
MoodleFixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=2106273refmoodle.org/mod/forum/discuss.php?d=436456refgit.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75044advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3advisorylists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V