A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier     unsupported versions. The calendar:manageentries capability allowed managers to access or modify any     calendar event, but should have been restricted from accessing user level events. (CVE-2022-0333)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier
    unsupported versions. The calendar:manageentries capability allowed managers to access or modify any
    calendar event, but should have been restricted from accessing user level events. (CVE-2022-0333)

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.12, 3.10.x prior to 3.10.9 or 3.11.x prior to 3.11.5. It is, therefore, affected by multiple vulnerabilities:

 - An SQL injection vulnerability in the h5p activity web service responsible for fetching user attempt data. (CVE-2022-0332)

 - An authorization issue in the calendar:manageentries capability allowing managers to access or modify any calendar event. (CVE-2022-0333)

 - An authorization issue allowing users to access their grade report for courses where they did not have the required gradereport/user:view capability. (CVE-2022-0334)

 - A Cross-Site Request Forgery (CSRF) vulnerability due to the lack of token check in the 'delete badge alignment' functionality. (CVE-2022-0335)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Severity
261262	Linux Distros Unpatched Vulnerability : CVE-2022-0333	Nessus	Misc.	low
416703	SCA: security update for moodle/moodle (GHSA-m434-m5pv-p35w)	Tenable Cloud Security	SCA Checks	low
416703	SCA: security update for moodle/moodle (GHSA-m434-m5pv-p35w)	Tenable Self-Hosted Container Security	SCA Checks	low
113612	Moodle 3.11.x < 3.11.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113611	Moodle 3.10.x < 3.10.9 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113610	Moodle 3.9.x < 3.9.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2022-0333

low

Tenable Plugins

low

low

low

critical

critical

critical