A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier     unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to     prevent a reflected XSS risk. (CVE-2021-43558)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier
    unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to
    prevent a reflected XSS risk. (CVE-2021-43558)

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.11, 3.10.x prior to 3.10.8 or 3.11.x prior to 3.11.4. It is, therefore, affected by multiple vulnerabilities:

- A Remote Code Execution when restoring malformed backup files. (CVE-2021-3943)

- A vulnerable version of mlbackend python library included in Moodle.

- A Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization in or an URL parameter in the filetype site administrator tool. (CVE-2021-43558)

- A Cross-Site Request Forgery (CSRF) vulnerability due to the lack of token check in the 'delete related badge' functionality. (CVE-2021-43559)

- An Insecure Direct Object Reference (IDOR) vulnerability allowing users to fetch other users calendar action events. (CVE-2021-43560)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Type	Severity
260641	Linux Distros Unpatched Vulnerability : CVE-2021-43558	Nessus	Misc.	Local	medium
420033	SCA: security update for moodle/moodle (GHSA-wpfp-q843-v772)	Tenable Cloud Security	SCA Checks	Local	medium
420033	SCA: security update for moodle/moodle (GHSA-wpfp-q843-v772)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
113615	Moodle 3.11.x < 3.11.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
113614	Moodle 3.10.x < 3.10.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
113613	Moodle 3.9.x < 3.9.11 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2021-43558

medium

Tenable Plugins

medium

medium

medium

critical

critical

critical