NetSight
IP …
critical9.8

CVE-2022-35649

Moodle PostScript Code Injection

Impact

The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected packages

EcosystemPackageAffectedFixed in
composermoodle/moodle>= 3.9, < 3.9.153.9.15

Affected products

VendorProductAffected versions
MoodleMoodle
from 3.9.0 before 3.9.15
from 3.11.0 before 3.11.8
from 4.0.0 before 4.0.2
FedoraprojectFedora
Versions 35, 36

Weakness classification

CWE-94CWE-20

References