Description

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

Remediation

References

CVE-2019-3810

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-32478)

WordPress Plugin Event Registration 'event_id' Parameter SQL Injection (5.44)

Joomla! Core 3.4.x Directory Traversal (3.4.0 - 3.4.5)

WordPress Plugin Resize Image After Upload Cross-Site Request Forgery (1.8.5)

Jboss EAP Other Vulnerability (CVE-2019-9513)

Severity

Medium

Classification

CVE-2019-3810 CWE-200 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities