According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.25 / 3.11.x prior to 3.11.18 / 4.0.x prior to 4.0.12 / 4.1.x prior to 4.1.7 / 4.2.x prior to 4.2.4. It is, therefore, affected by multiple vulnerabilities:

- XSS risk when manually running a task in the admin UI

- Badge recipients are available to all users

- Survey responses did not respect group settings

- Logs and Live logs course reports did not respect activity group settings

- Authenticated remote code execution risk in course blocks

- DOS risk in URL downloader

- Authenticated remote code execution risk in logstore as manager

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114733	Moodle 4.2.x < 4.2.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
114732	Moodle 4.1.x < 4.1.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
114731	Moodle 4.0.x < 4.0.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
114730	Moodle 3.11.x < 3.11.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
114729	Moodle < 3.9.25 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high

Detections

Analytics

CVE-2023-6661

No Score

Tenable Plugins

high

high

high

high

high