According to its self-reported version, the Moodle install hosted on the remote host is prior to 3.9.20, 3.11.x prior to 3.11.13, 4.0.x prior to 4.0.7 or 4.1.x prior to 4.1.2. It is, therefore, affected by multiple vulnerabilities.

- The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

- Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.

- The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implemented/exploitable anywhere in the core Moodle LMS).

- If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.

- Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.

- Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.

- Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Insufficient validation of profile field availability condition resulted in an SQL injection risk (by
    default only available to teachers and managers). (CVE-2023-28329)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d9c13996b2 advisory.

    Fixes for multiple CVEs.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient validation of profile field availability condition resulted in an SQL injection risk (by     default only available to teachers and managers). (CVE-2023-28329)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
114767	Moodle < 3.9.20 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	critical
114765	Moodle 4.0.x < 4.0.7 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	critical
114766	Moodle 3.11.x < 3.11.13 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	critical
114764	Moodle 4.1.x < 4.1.2 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/10/2025	4/10/2025	critical
411753	SCA: security update for moodle/moodle (GHSA-72w2-j52c-7682)	Tenable Cloud Security	SCA Checks	1/23/2025	7/2/2026	high
411753	SCA: security update for moodle/moodle (GHSA-72w2-j52c-7682)	Tenable Self-Hosted Container Security	SCA Checks	1/23/2025	7/2/2026	high
173675	Fedora 36 : moodle (2023-d9c13996b2)	Nessus	Fedora Local Security Checks	3/30/2023	11/14/2024	critical
260576	Linux Distros Unpatched Vulnerability : CVE-2023-28329	Nessus	Misc.	9/2/2025	7/12/2026	high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high

high

critical

high