[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ad23fa61-30cf-4c2f-93de-0be84d728330@oracle.com>
Date: Tue, 29 Sep 2026 09:53:01 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: Moodle LMS 3.9.2: authenticated file-upload
validation bypass (CWE-434) leading to RCE under misconfiguration
On 9/28/26 10:34, Muhammad Arslan Official wrote:
> I am disclosing a vulnerability in Moodle LMS and requesting a CVE ID, as
> the
> vendor (a registered CNA) has not assigned one after coordinated disclosure,
> and a MITRE CNA-LR request (CAN-2026-2032565) has been under review for ~3
> months without response.
oss-security is not a CNA and cannot issue CVE IDs. Before 2017, the
MITRE CNA-LR used to accept CVE requests via this mailing list, but they
stopped in 2017 and redirected people to their web forms instead [1], so
this has never been a way to bypass MITRE to get a CVE assignment.
[1] https://www.openwall.com/lists/oss-security/2017/02/09/7
--
-Alan Coopersmith- alan.coopersmith@...cle.com
Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
