The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal     information to non-editing teachers about attempts/users in groups they should not have access to.
    (CVE-2022-40316)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal
    information to non-editing teachers about attempts/users in groups they should not have access to.
    (CVE-2022-40316)

The version of Moodle installed on the remote host is 3.9.x prior to 3.9.17, 3.11.x prior to 3.11.10 or 4.0.x prior to 4.0.4. It is, therefore, affected by multiple vulnerabilities:

- A stored Cross-Site Scripting (XSS) and page Denial of Service (DoS) vulnerabilities due to recursive rendering in Mustache template helpers. (CVE-2022-40313)

- A Remote Code Execution (RCE) vulnerability when restoring backup files originating from Moodle 1.9. (CVE-2022-40314)

- A limited SQL injection vulnerability in the "browse list of users" site administration page. (CVE-2022-40315)

- An information disclosure in the H5P activity attempts report not filtering by groups, leading to data exposure to non-editing teachers about attempts and users in groups they should not have access to. (CVE-2022-40316)

- An improper access control in some quiz web services allowing students to bypass sequential navigation during a quiz attempt. (CVE-2022-40208)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

ID	Name	Product	Family	Type	Severity
260728	Linux Distros Unpatched Vulnerability : CVE-2022-40316	Nessus	Misc.	Local	medium
422043	SCA: security update for moodle/moodle (GHSA-385f-vgq7-8hhx)	Tenable Cloud Security	SCA Checks	Local	medium
422043	SCA: security update for moodle/moodle (GHSA-385f-vgq7-8hhx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
113596	Moodle 4.0.x < 4.0.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
113595	Moodle 3.11.x < 3.11.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical
113594	Moodle 3.9.x < 3.9.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2022-40316

medium

Tenable Plugins

medium

medium

medium

critical

critical

critical