Detections
Analytics
Moodle 4.0.x < 4.0.10 phpCAS Library Upgrade
high Web App Scanning Plugin ID 114748
Language:
Synopsis
Moodle 4.0.x < 4.0.10 phpCAS Library UpgradeDescription
According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.23, 3.11.x prior to 3.11.16 or 4.0.x prior to 4.0.10. The phpCAS library included with Moodle has been upgraded to version 1.6.0, which includes a fix for a serious security issue.Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Moodle version 4.0.10 or later.See Also
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-78620
Plugin Details
Severity: High
ID: 114748
Type: remote
Family: Component Vulnerability
Published: 4/10/2025
Updated: 4/10/2025
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2022-39369
CVSS v3
Risk Factor: High
Base Score: 8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2022-39369
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 10/30/2022
Reference Information
CVE: CVE-2022-39369
OWASP: 2010-A1, 2013-A1, 2013-A9, 2017-A1, 2017-A9, 2021-A3, 2021-A6
WASC: Improper Input Handling, Improper Output Handling
CAPEC: 10, 101, 104, 108, 110, 120, 13, 135, 14, 24, 250, 267, 273, 28, 3, 34, 42, 43, 45, 46, 47, 51, 52, 53, 6, 64, 67, 7, 71, 72, 76, 78, 79, 8, 80, 83, 84, 9
DISA STIG: APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2)
ISO: 27001-A.14.2.5
NIST: sp800_53-CM-6b, sp800_53-SI-10
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.2.1, 4.0.2-5.2.5