The version of Moodle installed on the remote host is 3.9.x prior to 3.9.11, 3.10.x prior to 3.10.8 or 3.11.x prior to 3.11.4. It is, therefore, affected by multiple vulnerabilities:
A Remote Code Execution when restoring malformed backup files. (CVE-2021-3943)
A vulnerable version of mlbackend python library included in Moodle.
A Cross-Site Scripting (XSS) vulnerability due to the lack of sanitization in or an URL parameter in the filetype site administrator tool. (CVE-2021-43558)
A Cross-Site Request Forgery (CSRF) vulnerability due to the lack of token check in the ‘delete related badge’ functionality. (CVE-2021-43559)
An Insecure Direct Object Reference (IDOR) vulnerability allowing users to fetch other users calendar action events. (CVE-2021-43560)
Note that the scanner has not attempted to exploit this issue but has instead relied only on application’s self-reported version number.
No source data
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3943
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43558
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43559
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43560
moodle.org/mod/forum/discuss.php?d=429095#p1726798
moodle.org/mod/forum/discuss.php?d=429096#p1726799
moodle.org/mod/forum/discuss.php?d=429097#p1726802
moodle.org/mod/forum/discuss.php?d=429099#p1726805
moodle.org/mod/forum/discuss.php?d=429100#p1726807