9.8

CVE-2022-44544

Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mahara ≫ Mahara Version >= 21.04.0 < 21.04.7
   Canonical ≫ Ubuntu Linux Version 18.04
Mahara ≫ Mahara Version >= 21.10.0 < 21.10.5
   Canonical ≫ Ubuntu Linux Version 18.04
Mahara ≫ Mahara Version >= 22.04.0 < 22.04.3
   Canonical ≫ Ubuntu Linux Version 18.04
Mahara ≫ Mahara Version 22.10.0 Update rc1
   Canonical ≫ Ubuntu Linux Version 18.04
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.78% 0.53
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

https://bugs.launchpad.net/mahara/+bug/1979575
Vendor Advisory
Issue Tracking
https://mahara.org/interaction/forum/topic.php?id=9198
Vendor Advisory