Description

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

Remediation

References

CVE-2019-3810

Related Vulnerabilities

ownCloud Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2013-2045)

Jenkins Other Vulnerability (CVE-2016-3726)

WordPress Plugin Event Notifier Cross-Site Scripting (1.2.0)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-7849)

PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2010-2190)

Severity

Medium

Classification

CVE-2019-3810 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities