The version of Moodle installed on the remote host is 3.9.x prior to 3.9.18, 3.11.x prior to 3.11.11 or 4.0.x prior to 4.0.5. It is, therefore, affected by multiple vulnerabilities:

 - An information disclosure due to a user CSRF token being unnecessarily included in the URL during the redirection to a course which has been just restored. (CVE-2022-45149)

 - A Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization of the return URL in the policy tool. (CVE-2022-45150)

 - A stored Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization of the 'social' user profile field type. (CVE-2022-45151)

 - A blind Server-Side Request Forgery (SSRF) vulnerability due to the LTI provider library not using Moodle inbuilt cURL helper. (CVE-2022-45152)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-f7fdcb1820 advisory.

  - This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML     escaping and execute arbitrary code. (CVE-2021-23414)

  - A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin     in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to     a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web     page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an     attacker to perform cross-site request forgery attacks. (CVE-2022-45149)

  - A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to     insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a     specially crafted link that executes an arbitrary HTML and script code in user's browser in context of     vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks     to gain access potentially sensitive information and modification of web pages. (CVE-2022-45150)

  - The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of     user-supplied data in several social user profile fields. An attacker could inject and execute arbitrary     HTML and script code in user's browser in context of vulnerable website. (CVE-2022-45151)

  - A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to     insufficient validation of user-supplied input in LTI provider library. The library does not utilise     Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially     crafted HTTP request and trick the application to initiate requests to arbitrary systems. This     vulnerability allows a remote attacker to perform SSRF attacks. (CVE-2022-45152)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-cb7084ae1c advisory.

  - This affects the package video.js before 7.14.3. The src attribute of track tag allows to bypass HTML     escaping and execute arbitrary code. (CVE-2021-23414)

  - A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin     in course redirect URL. A user's CSRF token was unnecessarily included in the URL when being redirected to     a course they have just restored. A remote attacker can trick the victim to visit a specially crafted web     page and perform arbitrary actions on behalf of the victim on the vulnerable website. This flaw allows an     attacker to perform cross-site request forgery attacks. (CVE-2022-45149)

  - A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to     insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a     specially crafted link that executes an arbitrary HTML and script code in user's browser in context of     vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks     to gain access potentially sensitive information and modification of web pages. (CVE-2022-45150)

  - The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of     user-supplied data in several social user profile fields. An attacker could inject and execute arbitrary     HTML and script code in user's browser in context of vulnerable website. (CVE-2022-45151)

  - A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to     insufficient validation of user-supplied input in LTI provider library. The library does not utilise     Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially     crafted HTTP request and trick the application to initiate requests to arbitrary systems. This     vulnerability allows a remote attacker to perform SSRF attacks. (CVE-2022-45152)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
113589	Moodle 3.9.x < 3.9.18 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	critical
113590	Moodle 3.11.x < 3.11.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	critical
113591	Moodle 4.0.x < 4.0.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	critical
169254	Fedora 36 : moodle (2022-f7fdcb1820)	Nessus	Fedora Local Security Checks	12/23/2022	9/12/2023	critical
169079	Fedora 35 : moodle (2022-cb7084ae1c)	Nessus	Fedora Local Security Checks	12/22/2022	9/12/2023	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical