CVE-2022-35650

The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

49.34% chance of exploitation in the next 30 days, 99th percentile

Published

2022-07-25

Updated

2024-08-03

Proof-of-concept exploits (1)

• Gr4y-r0se/CVE-2022-35650

References

• CVE Record
• NVD entry

Related

• CVE-2022-35649
• CVE-2022-35653
• CVE-2022-3564
• CVE-2022-3569
• CVE-2022-35624
• CVE-2022-3570