The vulnerability of the virtual learning environment Moodle, related to incorrect validation of input data, allows a violator to execute arbitrary code.

🗓️ 21 Oct 2022 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Moodle vulnerability allows remote code execution due to incorrect validation during PostScript syntax analysis.

Reporter	Title	Published	Views	Family All 141
GithubExploit	Exploit for Improper Input Validation in Moodle	6 Mar 202310:09	–	githubexploit
ATTACKERKB	CVE-2022-35649	25 Jul 202216:15	–	attackerkb
BDU FSTEC	The vulnerability of the Moodle virtual training environment, which arises due to the lack of measures taken to protect the structure of the web page, allows a hacker to execute arbitrary code and disclose the protected information.	10 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the implementation of automatic login for mobile devices in the virtual training environment Moodle allows a hacker to carry out a phishing attack and expose the protected information.	10 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the LTI module in the virtual learning environment Moodle, which allows attackers to carry out phishing attacks or expose sensitive information	10 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability in the virtual learning environment Moodle, related to insufficient cleaning of user data, allows a hacker to execute arbitrary SQL commands.	20 Oct 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the H5P plugin in the virtual learning environment Moodle, which allows a intruder to gain unauthorized access to protected information	21 Oct 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the virtual learning environment Moodle, related to the restoration of unreliable data in memory, allows a perpetrator to execute arbitrary code.	21 Oct 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the implementation of the recursive rendering function for the Mustache helper components in the Moodle template system allows attackers to perform cross-site scripting attacks or cause service failures.	21 Oct 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the virtual learning environment Moodle, related to insufficient verification of input data, allows a perpetrator to disclose protected information.	21 Oct 202200:00	–	bdu_fstec

Vulners

Node

fedora fedoraMatch35

OR

fedora fedoraMatch36

Source	Link
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-moodle-cve-2022-40316-cve-2022-40315-cve-2022-40314-cve-2022-40313-cve-20/
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
git	www.git.moodle.org/gw
moodle	www.moodle.org/mod/forum/discuss.php
goslinux	www.goslinux.fssp.gov.ru/2726972/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/6MOKYVRNFNAODP2XSMGJ5CRDUZCZKAR3/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/MTKUSFPSYFINSQFSOHDQIDVE6FWBEU6V/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-35649
web	www.web.nvd.nist.gov/view/vuln/detail

21 Oct 2022 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 39.8

CVSS 210

EPSS0.07485

Moodle PostScript input validation syntax analysis remote code execution arbitrary code vulnerability