high7.5
CVE-2024-43426
Moodle has arbitrary file read risk through pdfTeX
Impact
A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | moodle/moodle | < 4.1.12 | 4.1.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Moodle | Moodle | from 4.1.0 before 4.1.12 from 4.2.0 before 4.2.9 from 4.3.0 before 4.3.6 from 4.4.0 before 4.4.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2304254
- https://moodle.org/mod/forum/discuss.php?d=461194
- https://github.com/advisories/GHSA-vjmm-r9gg-425m
- https://nvd.nist.gov/vuln/detail/CVE-2024-43426
- https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82745