GHSA-xp2f-9mx3-3c6pCriticalCVSS 9.8

Moodle PostScript Code Injection

Published
July 26, 2022
Last Modified
April 23, 2024

🔗 CVE IDs covered (1)

CVE-2022-35649 →

📋 Description

The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote code execution risk for sites running GhostScript versions older than 9.50. Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

🎯 Affected products3

  • composer/moodle/moodle:>= 3.9, < 3.9.15
  • composer/moodle/moodle:>= 3.11, < 3.11.8
  • composer/moodle/moodle:>= 4.0, < 4.0.2

🔗 References (7)