The version of Moodle installed on the remote host is 3.5.x prior to 3.5.17, 3.8.x prior to 3.8.8, 3.9.x prior to 3.9.5 or 3.10.x prior to 3.10.2. It is, therefore, affected by multiple vulnerabilities:

- A stored Cross-Site Scripting (XSS) vulnerability attack due to the lack of sanitization of the user profile ID field. (CVE-2021-20279)

- A stored Cross-Site Scripting (XSS) and blind Server-Side Request Forgery (SSRF) vulnerabilities due to the lack of sanitization of text-based feedback answers. (CVE-2021-20280)

- An information disclosure exposing other users full names via the online users block. (CVE-2021-20281)

- A bypass in the email verification process when confirming an account registration. (CVE-2021-20282)

- An Insecure Direct Object Reference (IDOR) allowing an user to request other users enrolled courses through the web service. (CVE-2021-20283)

- A vulnerable jQuery component. (CVE-2020-11022, CVE-2020-11023)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle
    before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-431b232659 advisory.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

  - Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in     moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20280)

  - It was possible for some users without permission to view other users' full names to do so via the online     users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20281)

  - When creating a user account, it was possible to verify the account without having access to the     verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20282)

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-50f63a0161 advisory.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

  - Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in     moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20280)

  - It was possible for some users without permission to view other users' full names to do so via the online     users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20281)

  - When creating a user account, it was possible to verify the account without having access to the     verification email link/secret in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20282)

  - The web service responsible for fetching other users' enrolled courses did not validate that the     requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5,     3.8.8, 3.5.17. (CVE-2021-20283)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle     before 3.10.2, 3.9.5, 3.8.8, 3.5.17. (CVE-2021-20279)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
113628	Moodle 3.9.x < 3.9.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	medium
113627	Moodle 3.8.x < 3.8.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	medium
113629	Moodle 3.10.x < 3.10.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	medium
113626	Moodle 3.5.x < 3.5.17 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	medium
434315	SCA: security update for moodle/moodle (GHSA-h7h6-fwpv-ggvx)	Tenable Cloud Security	SCA Checks	8/19/2025	7/2/2026	medium
434315	SCA: security update for moodle/moodle (GHSA-h7h6-fwpv-ggvx)	Tenable Self-Hosted Container Security	SCA Checks	8/19/2025	7/2/2026	medium
147958	Fedora 33 : moodle (2021-431b232659)	Nessus	Fedora Local Security Checks	3/23/2021	1/9/2024	medium
147959	Fedora 32 : moodle (2021-50f63a0161)	Nessus	Fedora Local Security Checks	3/23/2021	1/9/2024	medium
260644	Linux Distros Unpatched Vulnerability : CVE-2021-20279	Nessus	Misc.	9/2/2025	9/2/2025	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium