CVE-2022-35650: Moodle Arbitrary file read when importing lesson questions
Insufficient path checks in a lesson question import resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Versions affected: 4.0 to 4.0.1, 3.11 to 3.11.7, 3.9 to 3.9.14 and earlier unsupported versions Versions fixed: 4.0.2, 3.11.8 and 3.9.15
Other sources
Moodle Arbitrary file read when importing lesson questions
— Packagist
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.11.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 3.9.15 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.11.8 - Upgrade
Upgrade
redhat/moodleto a version that resolves this vulnerability.Fixed in 3.9.15 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 4.0.2 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.11.8 - Upgrade
Upgrade
Moodleto a version that resolves this vulnerability.Fixed in 3.9.15
Event History
Frequently Asked Questions
What is CVE-2022-35650?
CVE-2022-35650 is a vulnerability found in Moodle that occurs due to input validation error when importing lesson questions.
What is the severity of CVE-2022-35650?
The severity of CVE-2022-35650 is high with a CVSS score of 7.5.
How does CVE-2022-35650 affect Moodle?
CVE-2022-35650 allows a remote attacker to perform directory traversal attacks by exploiting a path traversal vulnerability in Moodle.
Which versions of Moodle are affected by CVE-2022-35650?
Versions 3.9.0 to 3.9.15, 3.11.0 to 3.11.8, and 4.0.0 to 4.0.2 of Moodle are affected by CVE-2022-35650.
How can I fix the CVE-2022-35650 vulnerability in Moodle?
To fix the CVE-2022-35650 vulnerability in Moodle, you should update to version 3.9.15, 3.11.8, or 4.0.2.