description: The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary file read risk. This vulnerability allows a remote attacker to perform directory traversal attacks. The capability to access this feature is only available to teachers, managers and admins by default.
problem types: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: Moodle
vendor: n/a
versions:
status: affected, version: Fixed in moodle 4.0.2, moodle 3.11.8, moodle 3.9.15
}