Description

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

Remediation

References

CVE-2019-3810

Related Vulnerabilities

WordPress Plugin Qyrr-simply and modern QR-Code creation Cross-Site Scripting (0.6)

MySQL Resource Management Errors Vulnerability (CVE-2010-3833)

WordPress Plugin Drag & Drop File Uploader 'dnd-upload.php' Arbitrary File Upload (0.1)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Directory Traversal (1.7.14.2)

WordPress Plugin YITH WooCommerce Advanced Reviews Security Bypass (1.3.9)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2019-3810