medium4.9
CVE-2021-40694
Moodle Improper Encoding or Escaping of Output
Impact
Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | >= 3.9, < 3.9.10 | 3.9.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | before 3.9.10 from 3.10.0 before 3.10.7 from 3.11.0 before 3.11.3 |