CVE-2009-1171: Input Validation
Published Mar 30, 2009
·Updated
The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.
Affected Software
27 affected components
Moodle moodle=1.9.4
Moodle moodle=1.9.1
Moodle moodle=1.8.8
Moodle moodle=1.6.1
Moodle moodle=1.8.2
Moodle moodle=1.6.8
Moodle moodle=1.6.5
Moodle moodle=1.7.6
Moodle moodle=1.6.2
Moodle moodle=1.9.2
Moodle moodle=1.8.6
Moodle moodle=1.7.1
Moodle moodle=1.8.5
Moodle moodle=1.8.3
Moodle moodle=1.8.7
Moodle moodle=1.6.4
Moodle moodle=1.9.3
Moodle moodle=1.6.7
Moodle moodle=1.7.3
Moodle moodle=1.7.2
Moodle moodle=1.6.3
Moodle moodle=1.6.6
Moodle moodle=1.7.5
Moodle moodle=1.8.4
Moodle moodle=1.8.1
Moodle moodle=1.7.4
Moodle moodle=1.6.0
Event History
Mar 30, 2009
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Data Sourced
via NVD·10:30 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2009-1171?
CVE-2009-1171 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2009-1171?
To fix CVE-2009-1171, upgrade Moodle to version 1.6.9+, 1.7.7+, 1.8.9, or 1.9.5 or later.
3
What systems are affected by CVE-2009-1171?
CVE-2009-1171 affects Moodle versions 1.6.0 to 1.9.4 inclusive.
4
Can CVE-2009-1171 lead to data exposure?
Yes, CVE-2009-1171 can allow user-assisted attackers to read arbitrary files, potentially exposing sensitive data.
5
Is user interaction required for CVE-2009-1171 to be exploited?
Yes, exploitation of CVE-2009-1171 requires user assistance, as attackers must manipulate the input commands.