moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter     insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results     of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious     link containing JavaScript in the search parameter. (CVE-2018-14631)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter
    insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results
    of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious
    link containing JavaScript in the search parameter. (CVE-2018-14631)

moodle reports :

Moodle XML import of ddwtos could lead to intentional remote code execution

QuickForm library remote code vulnerability (upstream)

Boost theme - blog search GET parameter insufficiently filtered

ID	Name	Product	Family	Severity
260692	Linux Distros Unpatched Vulnerability : CVE-2018-14631	Nessus	Misc.	medium
434244	SCA: security update for moodle/moodle (GHSA-gqrp-qhv8-phrv)	Tenable Cloud Security	SCA Checks	medium
434244	SCA: security update for moodle/moodle (GHSA-gqrp-qhv8-phrv)	Tenable Self-Hosted Container Security	SCA Checks	medium
117594	FreeBSD : moodle -- multiple vulnerabilities (074cb225-bb2d-11e8-90e1-fcaa147e860e)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-14631

medium

Tenable Plugins

medium

medium

medium

critical