CVE-2022-35650: Input Validation
Insufficient path checks in a lesson question import resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
Versions affected: 4.0 to 4.0.1, 3.11 to 3.11.7, 3.9 to 3.9.14 and earlier unsupported versions Versions fixed: 4.0.2, 3.11.8 and 3.9.15
Other sources
The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-35650?
CVE-2022-35650 is a vulnerability found in Moodle that occurs due to input validation error when importing lesson questions.
What is the severity of CVE-2022-35650?
The severity of CVE-2022-35650 is high with a CVSS score of 7.5.
How does CVE-2022-35650 affect Moodle?
CVE-2022-35650 allows a remote attacker to perform directory traversal attacks by exploiting a path traversal vulnerability in Moodle.
Which versions of Moodle are affected by CVE-2022-35650?
Versions 3.9.0 to 3.9.15, 3.11.0 to 3.11.8, and 4.0.0 to 4.0.2 of Moodle are affected by CVE-2022-35650.
How can I fix the CVE-2022-35650 vulnerability in Moodle?
To fix the CVE-2022-35650 vulnerability in Moodle, you should update to version 3.9.15, 3.11.8, or 4.0.2.