A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.
    (CVE-2022-40314)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.17, 3.11.x prior to 3.11.10 or 4.0.x prior to 4.0.4. It is, therefore, affected by multiple vulnerabilities:

 - A stored Cross-Site Scripting (XSS) and page Denial of Service (DoS) vulnerabilities due to recursive rendering in Mustache template helpers. (CVE-2022-40313)

 - A Remote Code Execution (RCE) vulnerability when restoring backup files originating from Moodle 1.9. (CVE-2022-40314)

 - A limited SQL injection vulnerability in the "browse list of users" site administration page. (CVE-2022-40315)

 - An information disclosure in the H5P activity attempts report not filtering by groups, leading to data exposure to non-editing teachers about attempts and users in groups they should not have access to. (CVE-2022-40316)

 - An improper access control in some quiz web services allowing students to bypass sequential navigation during a quiz attempt. (CVE-2022-40208)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Severity
260598	Linux Distros Unpatched Vulnerability : CVE-2022-40314	Nessus	Misc.	critical
113596	Moodle 4.0.x < 4.0.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113595	Moodle 3.11.x < 3.11.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical
113594	Moodle 3.9.x < 3.9.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2022-40314

critical

Tenable Plugins

critical

critical

critical

critical