Lucene search

K
nessusThis script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.WEB_APPLICATION_SCANNING_113626
HistoryFeb 20, 2023 - 12:00 a.m.

Moodle 3.5.x < 3.5.17 Multiple Vulnerabilities

2023-02-2000:00:00
This script is Copyright (C) 2023-2024 and is owned by Tenable, Inc. or an Affiliate thereof.
www.tenable.com
21

The version of Moodle installed on the remote host is 3.5.x prior to 3.5.17, 3.8.x prior to 3.8.8, 3.9.x prior to 3.9.5 or 3.10.x prior to 3.10.2. It is, therefore, affected by multiple vulnerabilities:

  • A stored Cross-Site Scripting (XSS) vulnerability attack due to the lack of sanitization of the user profile ID field. (CVE-2021-20279)

  • A stored Cross-Site Scripting (XSS) and blind Server-Side Request Forgery (SSRF) vulnerabilities due to the lack of sanitization of text-based feedback answers. (CVE-2021-20280)

  • An information disclosure exposing other users full names via the online users block. (CVE-2021-20281)

  • A bypass in the email verification process when confirming an account registration. (CVE-2021-20282)

  • An Insecure Direct Object Reference (IDOR) allowing an user to request other users enrolled courses through the web service. (CVE-2021-20283)

  • A vulnerable jQuery component. (CVE-2020-11022, CVE-2020-11023)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application’s self-reported version number.

No source data
VendorProductVersion
amoodlemoodle
Related for WEB_APPLICATION_SCANNING_113626