A limited SQL injection risk was identified in the "browse list of users" site administration page.

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.17, 3.11.x prior to 3.11.10 or 4.0.x prior to 4.0.4. It is, therefore, affected by multiple vulnerabilities:

 - A stored Cross-Site Scripting (XSS) and page Denial of Service (DoS) vulnerabilities due to recursive rendering in Mustache template helpers. (CVE-2022-40313)

 - A Remote Code Execution (RCE) vulnerability when restoring backup files originating from Moodle 1.9. (CVE-2022-40314)

 - A limited SQL injection vulnerability in the "browse list of users" site administration page. (CVE-2022-40315)

 - An information disclosure in the H5P activity attempts report not filtering by groups, leading to data exposure to non-editing teachers about attempts and users in groups they should not have access to. (CVE-2022-40316)

 - An improper access control in some quiz web services allowing students to bypass sequential navigation during a quiz attempt. (CVE-2022-40208)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Severity
113596	Moodle 4.0.x < 4.0.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113595	Moodle 3.11.x < 3.11.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113594	Moodle 3.9.x < 3.9.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2022-40315

critical

Tenable Plugins

critical

critical

critical