Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

The version of Moodle installed on the remote host is 3.5.x prior to 3.5.17, 3.8.x prior to 3.8.8, 3.9.x prior to 3.9.5 or 3.10.x prior to 3.10.2. It is, therefore, affected by multiple vulnerabilities:

 - A stored Cross-Site Scripting (XSS) vulnerability attack due to the lack of sanitization of the user profile ID field. (CVE-2021-20279)

 - A stored Cross-Site Scripting (XSS) and blind Server-Side Request Forgery (SSRF) vulnerabilities due to the lack of sanitization of text-based feedback answers. (CVE-2021-20280)

 - An information disclosure exposing other users full names via the online users block. (CVE-2021-20281)

 - A bypass in the email verification process when confirming an account registration. (CVE-2021-20282)

 - An Insecure Direct Object Reference (IDOR) allowing an user to request other users enrolled courses through the web service. (CVE-2021-20283)

 - A vulnerable jQuery component. (CVE-2020-11022, CVE-2020-11023)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-50f63a0161 advisory.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

  - Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in     moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20280)

  - It was possible for some users without permission to view other users' full names to do so via the online     users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20281)

  - When creating a user account, it was possible to verify the account without having access to the     verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20282)

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-431b232659 advisory.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

  - Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in     moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20280)

  - It was possible for some users without permission to view other users' full names to do so via the online     users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20281)

  - When creating a user account, it was possible to verify the account without having access to the     verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20282)

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
113629	Moodle 3.10.x < 3.10.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113628	Moodle 3.9.x < 3.9.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113627	Moodle 3.8.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
113626	Moodle 3.5.x < 3.5.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium
147959	Fedora 32 : moodle (2021-50f63a0161)	Nessus	Fedora Local Security Checks	medium
147958	Fedora 33 : moodle (2021-431b232659)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2021-20280

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium