~ / search / GHSA-xp2f-9mx3-3c6p

GHSA-xp2f-9mx3-3c6p

Moodle PostScript Code Injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-35649

Packages

EcosystemPackageAffectedFixed in
Packagist moodle/moodle >= 3.9, < 3.9.15 3.9.15
Packagist moodle/moodle >= 3.11, < 3.11.8 3.11.8
Packagist moodle/moodle >= 4.0, < 4.0.2 4.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

References

External links from the advisory. They lead to third-party sites.