Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an XSS risk or a page failing to load.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an     XSS risk or a page failing to load. (CVE-2022-40313)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.17, 3.11.x prior to 3.11.10 or 4.0.x prior to 4.0.4. It is, therefore, affected by multiple vulnerabilities:

 - A stored Cross-Site Scripting (XSS) and page Denial of Service (DoS) vulnerabilities due to recursive rendering in Mustache template helpers. (CVE-2022-40313)

 - A Remote Code Execution (RCE) vulnerability when restoring backup files originating from Moodle 1.9. (CVE-2022-40314)

 - A limited SQL injection vulnerability in the "browse list of users" site administration page. (CVE-2022-40315)

 - An information disclosure in the H5P activity attempts report not filtering by groups, leading to data exposure to non-editing teachers about attempts and users in groups they should not have access to. (CVE-2022-40316)

 - An improper access control in some quiz web services allowing students to bypass sequential navigation during a quiz attempt. (CVE-2022-40208)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Severity
260622	Linux Distros Unpatched Vulnerability : CVE-2022-40313	Nessus	Misc.	high
113596	Moodle 4.0.x < 4.0.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113595	Moodle 3.11.x < 3.11.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113594	Moodle 3.9.x < 3.9.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2022-40313

high

Tenable Plugins

high

critical

critical

critical