Improper Input Validation Affecting moodle/moodle package, versions >=3.9.0, <3.9.15>=3.11.0, <3.11.8>=4.0.0, <4.0.2


Severity

Recommended
0.0
critical
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
1.76% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PHP-MOODLEMOODLE-6673170
  • published24 Apr 2024
  • disclosed26 Jul 2022
  • creditNick Wojciechowski

Introduced: 26 Jul 2022

CVE-2022-35649  (opens in a new tab)
CWE-20  (opens in a new tab)

How to fix?

Upgrade moodle/moodle to version 3.9.15, 3.11.8, 4.0.2 or higher.

Overview

moodle/moodle is a learning platform.

Affected versions of this package are vulnerable to Improper Input Validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of the vulnerable system.

CVSS Scores

version 3.1