Search for vulnerabilities
Vulnerability details: VCID-ck54-csmd-63d2
Vulnerability ID VCID-ck54-csmd-63d2
Aliases CVE-2024-43426
GHSA-vjmm-r9gg-425m
Summary Moodle has arbitrary file read risk through pdfTeX A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1287 Improper Validation of Specified Type of Input
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-43426
epss 0.0005 https://api.first.org/data/v1/epss?cve=CVE-2024-43426
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=2304254
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2304254
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2304254
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-vjmm-r9gg-425m
cvssv3.1 7.5 https://github.com/moodle/moodle
generic_textual MODERATE https://github.com/moodle/moodle
cvssv3.1 7.5 https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82745
generic_textual MODERATE https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82745
cvssv3.1 7.5 https://moodle.org/mod/forum/discuss.php?d=461194
generic_textual MODERATE https://moodle.org/mod/forum/discuss.php?d=461194
ssvc Track https://moodle.org/mod/forum/discuss.php?d=461194
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-43426
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-43426
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-43426
https://bugzilla.redhat.com/show_bug.cgi?id=2304254
https://github.com/moodle/moodle
https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82745
https://moodle.org/mod/forum/discuss.php?d=461194
https://nvd.nist.gov/vuln/detail/CVE-2024-43426
GHSA-vjmm-r9gg-425m https://github.com/advisories/GHSA-vjmm-r9gg-425m
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2304254
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:41:10Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2304254
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/moodle/moodle
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-82745
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://moodle.org/mod/forum/discuss.php?d=461194
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-07T14:41:10Z/ Found at https://moodle.org/mod/forum/discuss.php?d=461194
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-43426
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.15372
EPSS Score 0.0005
Published At June 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-01T12:10:32.746249+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-vjmm-r9gg-425m/GHSA-vjmm-r9gg-425m.json 36.1.3