Moodle 4.2.x < 4.2.7 Multiple Vulnerabilities

high Web App Scanning Plugin ID 114727

Language:

Synopsis

Description

According to its self-reported version, the Moodle install hosted on the remote host is prior to 4.1.10, or 4.2.x prior to 4.2.7 or 4.3.x prior to 4.3.3. It is, therefore, affected by multiple vulnerabilities.

- Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

- The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.

- ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.

- Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.

- Additional sanitizing was required when opening the equation editor, to prevent a stored XSS risk when editing another user's equation.

- Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.