Detections
Analytics
Moodle 3.9.x < 3.9.14 Multiple Vulnerabilities
critical Web App Scanning Plugin ID 113603
Language:
Synopsis
Moodle 3.9.x < 3.9.14 Multiple VulnerabilitiesDescription
The version of Moodle installed on the remote host is 3.9.x prior to 3.9.14, 3.10.x prior to 3.10.11, 3.11.x prior to 3.11.7 or 4.0.x prior to 4.0.1. It is, therefore, affected by multiple vulnerabilities:- A stored Cross-Site Scripting (XSS) vulnerability in ID numbers displayed when bulk allocating markers to assignments. (CVE-2022-30596)
- An improper handling of the description user field which is not hidden when being set as a hidden user field. (CVE-2022-30597)
- An information disclosure in the global search results which could include author information on some activities where a user may not otherwise have access to it. (CVE-2022-30598)
- An SQL injection in badges code relating to configuring criteria available to site administrators. (CVE-2022-30599)
- A bypass in the account lockout treshold due to an issue in the logic used to count failed login attempts. (CVE-2022-30600)
- A vulnerable version of mlbackend python library included in Moodle.
Note that the scanner has not attempted to exploit this issue but has instead relied only on application's self-reported version number.
Solution
Upgrade to version 3.9.14 or later.See Also
https://moodle.org/mod/forum/discuss.php?d=434578#p1748722
https://moodle.org/mod/forum/discuss.php?d=434579#p1748723
https://moodle.org/mod/forum/discuss.php?d=434580#p1748724
Plugin Details
Severity: Critical
ID: 113603
Type: remote
Family: Component Vulnerability
Published: 2/20/2023
Updated: 3/14/2023
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2022-30599
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2022-30599
Vulnerability Information
CPE: cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/17/2022
Vulnerability Publication Date: 5/17/2022
Reference Information
CVE: CVE-2022-30596, CVE-2022-30597, CVE-2022-30598, CVE-2022-30599, CVE-2022-30600
CWE: 200, 307, 472, 682, 79, 89
OWASP: 2010-A1, 2010-A2, 2010-A3, 2010-A4, 2010-A6, 2013-A1, 2013-A2, 2013-A3, 2013-A4, 2013-A5, 2013-A9, 2017-A1, 2017-A2, 2017-A5, 2017-A6, 2017-A7, 2017-A9, 2021-A1, 2021-A3, 2021-A6, 2021-A7, 2021-A8
WASC: Cross-Site Scripting, Improper Input Handling, Information Leakage, Insufficient Authentication, SQL Injection
CAPEC: 108, 109, 110, 116, 128, 129, 13, 16, 169, 209, 22, 224, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 470, 472, 49, 497, 508, 560, 565, 573, 574, 575, 576, 577, 588, 59, 591, 592, 60, 600, 616, 63, 643, 646, 651, 652, 653, 66, 7, 79, 85
DISA STIG: APSC-DV-000460, APSC-DV-002490, APSC-DV-002540, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a), 164.312(e)
ISO: 27001-A.14.2.5, 27001-A.9.1.2, 27001-A.9.2.3, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-6(1), sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-15
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-12.3.3, 4.0.2-14.2.1, 4.0.2-3.7.1, 4.0.2-5.3.3, 4.0.2-5.3.4, 4.0.2-8.3.4
PCI-DSS: 3.2-6.2, 3.2-6.5.1, 3.2-6.5.10, 3.2-6.5.7, 3.2-6.5.8