// For flags

CVE-2022-35650

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.

La vulnerabilidad se encontró en Moodle, es producido debido a un error de comprobación de entrada cuando son importadas las preguntas de las lecciones. Esta comprobación insuficiente de la ruta resulta en un riesgo de lectura arbitraria de archivos. Esta vulnerabilidad permite a un atacante remoto llevar a cabo ataques de salto de directorio. La capacidad de acceder a esta función sólo está disponible por defecto para profesores, manejadores y administradores

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-07-12 CVE Reserved
  • 2022-07-25 CVE Published
  • 2024-02-15 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Moodle
Search vendor "Moodle"
Moodle
Search vendor "Moodle" for product "Moodle"
>= 3.9.0 < 3.9.15
Search vendor "Moodle" for product "Moodle" and version " >= 3.9.0 < 3.9.15"
-
Affected
Moodle
Search vendor "Moodle"
Moodle
Search vendor "Moodle" for product "Moodle"
>= 3.11.0 < 3.11.8
Search vendor "Moodle" for product "Moodle" and version " >= 3.11.0 < 3.11.8"
-
Affected
Moodle
Search vendor "Moodle"
Moodle
Search vendor "Moodle" for product "Moodle"
>= 4.0.0 < 4.0.2
Search vendor "Moodle" for product "Moodle" and version " >= 4.0.0 < 4.0.2"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
35
Search vendor "Fedoraproject" for product "Fedora" and version "35"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
36
Search vendor "Fedoraproject" for product "Fedora" and version "36"
-
Affected