The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The web service responsible for fetching other users' enrolled courses did not validate that the
    requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,
    3.8.8, 3.5.17. (CVE-2021-20283)

The version of Moodle installed on the remote host is 3.5.x prior to 3.5.17, 3.8.x prior to 3.8.8, 3.9.x prior to 3.9.5 or 3.10.x prior to 3.10.2. It is, therefore, affected by multiple vulnerabilities:

- A stored Cross-Site Scripting (XSS) vulnerability attack due to the lack of sanitization of the user profile ID field. (CVE-2021-20279)

- A stored Cross-Site Scripting (XSS) and blind Server-Side Request Forgery (SSRF) vulnerabilities due to the lack of sanitization of text-based feedback answers. (CVE-2021-20280)

- An information disclosure exposing other users full names via the online users block. (CVE-2021-20281)

- A bypass in the email verification process when confirming an account registration. (CVE-2021-20282)

- An Insecure Direct Object Reference (IDOR) allowing an user to request other users enrolled courses through the web service. (CVE-2021-20283)

- A vulnerable jQuery component. (CVE-2020-11022, CVE-2020-11023)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-50f63a0161 advisory.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

  - Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in     moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20280)

  - It was possible for some users without permission to view other users' full names to do so via the online     users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20281)

  - When creating a user account, it was possible to verify the account without having access to the     verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20282)

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-431b232659 advisory.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

  - Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in     moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20280)

  - It was possible for some users without permission to view other users' full names to do so via the online     users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20281)

  - When creating a user account, it was possible to verify the account without having access to the     verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20282)

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
261351	Linux Distros Unpatched Vulnerability : CVE-2021-20283	Nessus	Misc.	Local	medium
433441	SCA: security update for moodle/moodle (GHSA-2m72-m5cw-3g9h)	Tenable Cloud Security	SCA Checks	Local	medium
433441	SCA: security update for moodle/moodle (GHSA-2m72-m5cw-3g9h)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
113629	Moodle 3.10.x < 3.10.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
113628	Moodle 3.9.x < 3.9.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
113627	Moodle 3.8.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
113626	Moodle 3.5.x < 3.5.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	medium
147959	Fedora 32 : moodle (2021-50f63a0161)	Nessus	Fedora Local Security Checks	Local	medium
147958	Fedora 33 : moodle (2021-431b232659)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2021-20283

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium