The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Moodle File Disclosure Vulnerability Systems Affected Moodle series <1.6.9+, <1.7.7+, <1.8.9, <1.9.5 Severity Critical Probability of being vulnerable Rather Low Vendor http://moodle.org/ Filed Bug #MDL-18552 Author Christian J. Eibl Date 20090327 I. BACKGROUND Moodle is an open source (webbased) learning management system with users all over the world in educational institutes, schools, or companies. See vendor homepage for details. II. DESCRIPTION An input filter for TeX formulas can be exploited to disclose files readable by the web server. This includes the moodle configuration file with all authentication data and server locations for directly connecting to backend database. TeX filter by default is off and in case of being activated mostly no complete LaTeX environment on a server system will be available. III. DETECTION OF VULNERABILITY Since Moodle 1.6 a complete LaTeX environment is preferred over the shipped mimetex program for rendering TeX formulas to images that can be included in HTML pages. In any text input area, e.g., forum, type something like "$$ \jobname $$" (without quotes). If the result looks like - "$$ \jobname $$": TeX filter not activated - "[jobname ?]": TeX filter activated, but mimetex used - "a91dbb..." (hash): TeX filter active and LaTeX used (vuln.) Since LaTeX per se is very powerful for file inclusion and even writes, the vulnerability depends on LaTeX environment and its configuration. IV. EXPLOIT PoC If LaTeX is not configured to restrict file inclusion (default!), then absolute paths and relative ones can be used. As proof of concept enter: "$$ \input{/etc/passwd} $$" In case the system is vulnerable, this will read the /etc/passwd file and will render the contents to an image included in the text. Hence, content is disclosed. Rendering takes place in temporary folder by default which should not be in the scope of the web server. Otherwise even arbitrary code could be injected to compromise the whole web environment. By using relative paths with background knowledge of Moodle's path organization, it is easy to disclose the configuration file with sensitive data. V. WORKAROUND Several alternatives: 1) deactivate TeX filter, if not needed 2) use more restrictive mimetex program for rendering 3) change LaTeX configuration (set "openin_any=p" for paranoid!) ... or upgrade to latest development version where patch should be applied by now. VI. TIMELINE 20090312 Bug discovered 20090313 Vendor contact / Bug filed (MDL-18552) 20090314 Response and confirmation by vendor 20090315 First patch proposed 20090327 Bug marked resolved and patch in tree # milw0rm.com [2009-03-27]