In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In a shared hosting environment that has been misconfigured to allow access to other users' content, a     Moodle user with both access to restore wiki modules and direct access to the web server outside of the     Moodle webroot could execute a local file include. (CVE-2024-34004)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its self-reported version, the Moodle install hosted on the remote host is prior to 4.1.10, or 4.2.x prior to 4.2.7 or 4.3.x prior to 4.3.3. It is, therefore, affected by multiple vulnerabilities.

- Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

- The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.

- Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.

- ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.

- Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.

- Additional sanitizing was required when opening the equation editor, to prevent a stored XSS risk when editing another user's equation.

- Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In a shared hosting environment that has been misconfigured to allow access to other users' content, a
    Moodle user with both access to restore wiki modules and direct access to the web server outside of the
    Moodle webroot could execute a local file include. (CVE-2024-34004)

ID	Name	Product	Family	Severity
260549	Linux Distros Unpatched Vulnerability : CVE-2024-34004	Nessus	Misc.	medium
114728	Moodle 4.3.x < 4.3.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
114727	Moodle 4.2.x < 4.2.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
114726	Moodle < 4.1.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	high
417832	SCA: security update for moodle/moodle (GHSA-q3cm-ccrm-2mr6)	Tenable Cloud Security	SCA Checks	medium
417832	SCA: security update for moodle/moodle (GHSA-q3cm-ccrm-2mr6)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2024-34004

medium

Tenable Plugins

medium

high

high

high

medium

medium