The version of Moodle installed on the remote host is 3.9.x prior to 3.9.10, 3.10.x prior to 3.10.7 or 3.11.x prior to 3.11.3. It is, therefore, affected by multiple vulnerabilities:

 - A session hijack vulnerability was identified in the Shibboleth authentication plugin, when enabled. (CVE-2021-40691)

 - An Insecure Direct Object Reference (IDOR) allowing teachers to download other courses users. (CVE-2021-40692)

 - An authentication bypass vulnerability was identified in the external database authentication functionality due to a type juggling vulnerability. (CVE-2021-40693)

 - An arbitrary file read due to an insufficient escaping of the LaTeX preamble allowing site administrators to read files available to the HTTP Server system account. (CVE-2021-40694)

 - An information disclosure allowing students to see their quiz grade through the quiz web service before its release. (CVE-2021-40695)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files     available to the HTTP server system account. (CVE-2021-40694)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
113618	Moodle 3.11.x < 3.11.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	medium
113617	Moodle 3.10.x < 3.10.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	medium
113616	Moodle 3.9.x < 3.9.10 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	medium
260812	Linux Distros Unpatched Vulnerability : CVE-2021-40694	Nessus	Misc.	9/3/2025	9/3/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium