Detections
Analytics
Moodle 3.5.x < 3.5.17 Multiple Vulnerabilities
medium Web App Scanning Plugin ID 113626
Language:
Synopsis
Moodle 3.5.x < 3.5.17 Multiple VulnerabilitiesDescription
The version of Moodle installed on the remote host is 3.5.x prior to 3.5.17, 3.8.x prior to 3.8.8, 3.9.x prior to 3.9.5 or 3.10.x prior to 3.10.2. It is, therefore, affected by multiple vulnerabilities:- A stored Cross-Site Scripting (XSS) vulnerability attack due to the lack of sanitization of the user profile ID field. (CVE-2021-20279)
- A stored Cross-Site Scripting (XSS) and blind Server-Side Request Forgery (SSRF) vulnerabilities due to the lack of sanitization of text-based feedback answers. (CVE-2021-20280)
- An information disclosure exposing other users full names via the online users block. (CVE-2021-20281)
- A bypass in the email verification process when confirming an account registration. (CVE-2021-20282)
- An Insecure Direct Object Reference (IDOR) allowing an user to request other users enrolled courses through the web service. (CVE-2021-20283)
- A vulnerable jQuery component. (CVE-2020-11022, CVE-2020-11023)
Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.
Solution
Upgrade to version 3.5.17 or later.See Also
https://moodle.org/mod/forum/discuss.php?d=419650#p1691259
https://moodle.org/mod/forum/discuss.php?d=419651#p1691260
https://moodle.org/mod/forum/discuss.php?d=419652#p1691268
https://moodle.org/mod/forum/discuss.php?d=419653#p1691269
Plugin Details
Severity: Medium
ID: 113626
Type: remote
Family: Component Vulnerability
Published: 2/20/2023
Updated: 3/14/2023
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 4.6
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2021-20281
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Score Source: CVE-2020-11022
Vulnerability Information
CPE: cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 3/15/2021
Vulnerability Publication Date: 3/15/2021
Reference Information
CVE: CVE-2020-11022, CVE-2020-11023, CVE-2021-20279, CVE-2021-20280, CVE-2021-20281, CVE-2021-20282, CVE-2021-20283
OWASP: 2010-A2, 2010-A6, 2010-A8, 2013-A3, 2013-A5, 2013-A7, 2013-A9, 2017-A5, 2017-A6, 2017-A7, 2017-A9, 2021-A1, 2021-A3, 2021-A6
WASC: Cross-Site Scripting, Information Leakage, Insufficient Authorization
CAPEC: 116, 13, 169, 209, 22, 224, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 472, 497, 508, 573, 574, 575, 576, 577, 588, 59, 591, 592, 60, 616, 63, 643, 646, 651, 79, 85
DISA STIG: APSC-DV-000460, APSC-DV-002490, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-15
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.3.3, 4.0.2-8.3.4