The remote web server hosts Moodle, an open-source course management system. Versions of Moodle 2.4.x prior to 2.4.11, 2.5.x prior to 2.5.7, 2.6.x prior to 2.6.4, 2.7.x prior to 2.7.1, and all previous releases are exposed to the following vulnerabilities :

  - The Repositories component allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data defined by add-ons that could include malicious code. (MSA-14-0021 / CVE-2014-3541)

  - An XML external entity (XXE) remote file disclosure flaw exists in the LTI module. Specifically, it is possible for manipulated XML files passed from LTI servers to be interpreted by Moodle to allow access to server-side files. (MSA-14-0022 / CVE-2014-3542)

  - An XML external entity (XXE) remote file disclosure flaw affects IMSCC and IMSCP modules in Moodle. Specifically, it is possible for manipulated XML files to be uploaded to the IMSCC course format or the IMSCP resource to allow access to server-side files. (MSA-14-0023 / CVE-2014-3543)

  - A remote code execution vulnerability exists in the Quiz system. It is possible to inject code into Calculated questions that would be executed on the server. (MSA-14-0025 / CVE-2014-3545)

  - An information disclosure flaw exists in the script '/user/edit.php' that is triggered by manipulating the URL. An authenticated remote attacker could exploit this to get limited user information, such as user name and courses. (MSA-14-0026 / CVE-2014-3546)

  - An error in forum permissions was allowing users who were members of more than one group to post to all groups without the capability to access all groups. (MSA-14-0027 / CVE-2014-3553)

  - A reflected cross-site scripting (XSS) vulnerability exists due to the content of exception dialogues presented from AJAX calls was not being escaped before being presented to users. (MSA-14-0029 / CVE-2014-3548)

  - Multiple cross-site scripting (XSS) vulnerabilities affect the advanced-grading implementation that could allow remote authenticated users to inject arbitrary web script or HTML via a specially crafted 'qualification' or 'rating' field in a rubric. (MSA-14-0032 / CVE-2014-3551)

  - A cross-site scripting (XSS) vulnerability exists in 'user/profile.php' that allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.	Exploits for this XSS vulnerability are publicly available. (MSA-14-0024 / CVE-2014-3544)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle
    through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow
    remote authenticated users to inject arbitrary web script or HTML via a crafted (1) qualification or (2)
    rating field in a rubric. (CVE-2014-3551)

遠端主機上安裝的 Moodle 版本受多個跨網站指令碼弱點影響，這是因為應用程式無法正確清理使用者對多個參數提供的輸入所導致。攻擊者可利用這些弱點，將任意 HTML 和指令碼插入使用者的瀏覽器，以便在受影響網站的安全性內容中執行。

請注意，Nessus 尚未針對每個問題進行測試，但已檢查修補的 JavaScript 檔案以確認修補的版本正在執行中。

远程主机上安装的 Moodle 版本受到多个跨站脚本漏洞的影响，这是应用程序无法正确审查用户向多种参数提供的输入所致。攻击者可利用这些漏洞将任意 HTML 和脚本代码注入到用户的浏览器，以便在受影响站点的安全环境中执行。

请注意，Nessus 未测试每个问题，但已检查经过修补的 JavaScript 文件来验证经过修补的版本是否正在运行。

複数のパラメーターに対するユーザー指定の入力をアプリケーションが適切にサニタイズできないために、リモートホストにインストールされているMoodleのバージョンが、複数のクロスサイトスクリプティング脆弱性の影響を受けます。攻撃者は、これらの脆弱性を利用して、任意のHTMLおよびスクリプトコードをユーザーのブラウザに送りこみ、影響を受けるサイトのセキュリティコンテキストで実行することができます。

注意: Nessusは各問題をテストしていませんが、パッチを適用したJavaScriptファイルをチェックし、パッチを適用したバージョンが実行されていることを検証しました。

The version of Moodle installed on the remote host is affected by multiple cross-site scripting vulnerabilities due to the application failing to properly sanitize user-supplied input to multiple parameters. An attacker can leverage these vulnerabilities to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

Note that Nessus has not tested for each issue, but has checked for patched JavaScript files to verify a patched version is running.

ID	名稱	產品	系列	已發布	已更新	嚴重性
8723	Moodle < 2.4 / 2.4.x < 2.4.11 / 2.5.x < 2.5.7 / 2.6.x < 2.6.4 / 2.7.x < 2.7.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2015/4/20	2019/3/6	high
437138	SCA: security update for moodle/moodle (GHSA-m8f5-9wg8-2c3h)	Tenable Cloud Security	SCA Checks	2026/1/27	2026/7/2	medium
437138	SCA: security update for moodle/moodle (GHSA-m8f5-9wg8-2c3h)	Tenable Self-Hosted Container Security	SCA Checks	2026/1/27	2026/7/2	medium
77983	Moodle 多個 XSS	Nessus	CGI abuses : XSS	2014/9/30	2025/5/14	medium
77983	Moodle 多个 XSS	Nessus	CGI abuses : XSS	2014/9/30	2025/5/14	medium
77983	Moodle の複数のXSS	Nessus	CGI abuses : XSS	2014/9/30	2025/5/14	medium
77983	Moodle Multiple XSS	Nessus	CGI abuses : XSS	2014/9/30	2025/5/14	medium

偵測

搜尋 Plugin

high

medium

medium

medium

medium

medium

medium