CVE-2024-43426: Moodle has arbitrary file read risk through pdfTeX
A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
Other sources
Moodle has arbitrary file read risk through pdfTeX
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.2 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.6 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.2.9 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.12
Event History
Frequently Asked Questions
What is the severity of CVE-2024-43426?
CVE-2024-43426 has been classified as a moderate severity vulnerability due to the risk of arbitrary file reading.
How do I fix CVE-2024-43426?
To fix CVE-2024-43426, upgrade to the latest recommended version of Moodle which includes the resolution for this vulnerability.
What versions of Moodle are affected by CVE-2024-43426?
Versions of Moodle from 4.1.0 to 4.4.1 are affected by CVE-2024-43426.
What is the nature of the vulnerability in CVE-2024-43426?
CVE-2024-43426 involves insufficient sanitizing in the TeX notation filter, leading to an arbitrary file read risk.
Is there a workaround for CVE-2024-43426 until I can apply the patch?
Currently, the recommended action is to update Moodle to a secure version as there are no known effective workarounds for CVE-2024-43426.