CVE-2009-1171

Published: Mar 30, 2009Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file.

Affected (27)

Products: Moodle: Moodle

1 product

Configuration A

27 vulnerable

Vulnerable Software	Affected Versions
Moodle Moodle	Version 1.6.0
Moodle Moodle	Version 1.6.1
Moodle Moodle	Version 1.6.2
Moodle Moodle	Version 1.6.3
Moodle Moodle	Version 1.6.4
Moodle Moodle	Version 1.6.5
Moodle Moodle	Version 1.6.6
Moodle Moodle	Version 1.6.7
Moodle Moodle	Version 1.6.8
Moodle Moodle	Version 1.7.1
Moodle Moodle	Version 1.7.2
Moodle Moodle	Version 1.7.3
Moodle Moodle	Version 1.7.4
Moodle Moodle	Version 1.7.5
Moodle Moodle	Version 1.7.6
Moodle Moodle	Version 1.8.1
Moodle Moodle	Version 1.8.2
Moodle Moodle	Version 1.8.3
Moodle Moodle	Version 1.8.4
Moodle Moodle	Version 1.8.5
Moodle Moodle	Version 1.8.6
Moodle Moodle	Version 1.8.7
Moodle Moodle	Version 1.8.8
Moodle Moodle	Version 1.9.1
Moodle Moodle	Version 1.9.2
Moodle Moodle	Version 1.9.3
Moodle Moodle	Version 1.9.4

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (28)

http://cvs.moodle.org/moodle/filter/tex/filter.php?r1=1.18.4.4&r2=1.18.4.5

Source: cve@mitre.org

Exploit

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html

Source: cve@mitre.org

http://secunia.com/advisories/34517

Source: cve@mitre.org

http://secunia.com/advisories/34557

Source: cve@mitre.org

http://secunia.com/advisories/34600

Source: cve@mitre.org

http://secunia.com/advisories/35570

Source: cve@mitre.org

http://tracker.moodle.org/browse/MDL-18552

Source: cve@mitre.org

http://www.debian.org/security/2009/dsa-1761

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/502231/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/34278

Source: cve@mitre.org

https://usn.ubuntu.com/791-2/

Source: cve@mitre.org

https://www.exploit-db.com/exploits/8297

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00077.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00079.html

Source: cve@mitre.org

http://cvs.moodle.org/moodle/filter/tex/filter.php?r1=1.18.4.4&r2=1.18.4.5

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34517

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34557

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/34600

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/35570

Source: af854a3a-2127-422b-91ae-364da2661108

http://tracker.moodle.org/browse/MDL-18552

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2009/dsa-1761

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/502231/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/34278

Source: af854a3a-2127-422b-91ae-364da2661108

https://usn.ubuntu.com/791-2/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.exploit-db.com/exploits/8297

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00077.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00079.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.