CVE-2022-44544

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-250

Affected software

No affected versions have been published.

Timeline

Published
Nov 6, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-445467.5The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation CVE-2022-445477.5The Display Service module has a UAF vulnerability. Successful exploitation of this vulnerability may affect the display service availabilitCVE-2022-445484.3There is a vulnerability in permission verification during the Bluetooth pairing process. Successful exploitation of this vulnerability may CVE-2022-445497.5The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to accCVE-2022-44556.1A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulatCVE-2022-445507.5The graphics display module has a UAF vulnerability when traversing graphic layers. Successful exploitation of this vulnerability may affectCVE-2022-445519.8The iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integriCVE-2022-445527.5The lock screen module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availabCVE-2022-445535.3The HiView module has a vulnerability of not filtering third-party apps out when the HiView module traverses to invoke the system provider. CVE-2022-445547.5The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of CVE-2022-445557.5The DDMP/ODMF module has a service hijacking vulnerability. Successful exploit of this vulnerability may cause services to be unavailable.CVE-2022-445567.5Missing parameter type validation in the DRM module. Successful exploitation of this vulnerability may affect availability.
CVE-2022-44544: Critical severity, CVSS 9.8 | Vulnix