The version of Moodle installed on the remote host is 3.9.x prior to 3.9.8, 3.10.x prior to 3.10.5 or 3.11.x prior to 3.11.1. It is, therefore, affected by multiple vulnerabilities:

- An SQL injection in the library fetching a user's enrolled courses. (CVE-2021-36392)

- An SQL injection in the library fetching a user's recent courses. (CVE-2021-36393)

- A Remote Code Execution (RCE) in the Shibboleth authentication plugin, when enabled. (CVE-2021-36394)

- A recursion Denial of Service (DoS) in the file repository's URL parsing function. (CVE-2021-36395)

- A blind Server-Side Request Forgery (SSRF) due to an insufficient redirect handling, leading to the bypass of cURL blocked hosts and allowed ports restrictions. (CVE-2021-36396)

- An Insecure Direct Object Reference (IDOR) vulnerability allowing an user to delete other user messages. (CVE-2021-36397)

- A stored Cross-Site Scripting (XSS) vulnerability in the ID numbers displayed in the web service token list. (CVE-2021-36398)

- A stored Cross-Site Scripting (XSS) vulnerability in the ID numbers displayed in the quiz override screens. (CVE-2021-36399)

- An Insecure Direct Object Reference (IDOR) vulnerability allowing an user to remove other users calendar URL subscriptions. (CVE-2021-36400)

- A stored Cross-Site Scripting (XSS) vulnerability in the ID numbers exported in HTML data formats being read locally. (CVE-2021-36401)

- An improper input validation in user names of account confirmation emails leading leading to phishing risks. (CVE-2021-36402)

- An improper input validation when processing email notifications containing HTML, leading to phishing risks. (CVE-2021-36403)

Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed
    ports restrictions, resulting in a blind SSRF risk. (CVE-2021-36396)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed     ports restrictions, resulting in a blind SSRF risk. (CVE-2021-36396)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
113619	Moodle 3.9.x < 3.9.8 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	critical
113620	Moodle 3.10.x < 3.10.5 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	critical
113621	Moodle 3.11.x < 3.11.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	2/20/2023	3/14/2023	critical
410378	SCA: security update for moodle/moodle (GHSA-4rmj-w58m-fvch)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high
410378	SCA: security update for moodle/moodle (GHSA-4rmj-w58m-fvch)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high
262585	Linux Distros Unpatched Vulnerability : CVE-2021-36396	Nessus	Misc.	9/10/2025	7/12/2026	high

Detections

Analytics

Plugins Search

critical

critical

critical

high

high

high