4.3
CVE-2009-1171
- EPSS 6.24%
- Veröffentlicht 30.03.2009 22:30:00
- Zuletzt bearbeitet 16.06.2026 23:06:39
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginThe TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 6.24% | 0.926 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 8.6 | 2.9 |
AV:N/AC:M/Au:N/C:P/I:N/A:N
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html
http://cvs.moodle.org/moodle/filter/tex/filter.php?r1=1.18.4.4&r2=1.18.4.5
http://secunia.com/advisories/34517
http://secunia.com/advisories/34557
http://secunia.com/advisories/34600
http://secunia.com/advisories/35570
http://tracker.moodle.org/browse/MDL-18552
http://www.debian.org/security/2009/dsa-1761
http://www.securityfocus.com/archive/1/502231/100/0/threaded
http://www.securityfocus.com/bid/34278
https://usn.ubuntu.com/791-2/
https://www.exploit-db.com/exploits/8297
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00077.html
https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00079.html