9.8

CVE-2022-44544

Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.

Data is provided by the National Vulnerability Database (NVD)
Mahara ≫ Mahara Version >= 21.04.0 < 21.04.7
   Canonical ≫ Ubuntu Linux Version18.04
Mahara ≫ Mahara Version >= 21.10.0 < 21.10.5
   Canonical ≫ Ubuntu Linux Version18.04
Mahara ≫ Mahara Version >= 22.04.0 < 22.04.3
   Canonical ≫ Ubuntu Linux Version18.04
Mahara ≫ Mahara Version22.10.0 Updaterc1
   Canonical ≫ Ubuntu Linux Version18.04
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.29% 0.52
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

https://bugs.launchpad.net/mahara/+bug/1979575
Vendor Advisory
Issue Tracking