CVE-2022-35650

Katalog CVE

CVSS 7.5 · High EPSS 53,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada moodle, fedoraproject fedora. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.

Rincian

Terbit di NVD

25 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-20: Improper Input Validation

EPSS (30 hari)

53,7% peluang dieksploitasi; lebih tinggi dari 98,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72029 patch · advisory vendor
• https://moodle.org/mod/forum/discuss.php?d=436457 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2106274 issue tracking · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6MOKYVRNFNAOD...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTKUSFPSYFINS...