PT-2019-16736 · Moodle · Moodle

Fariskhi Vidyan · Published 2019-03-25 · Updated 2022-11-07 · CVE-2019-3810

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions moodle versions 3.1 to 3.1.15 moodle versions 3.4 to 3.4.6 moodle versions 3.5 to 3.5.3 moodle versions 3.6 to 3.6.1

Description A flaw was found in the software where the /userpix/ page did not properly escape users' full names. These names are displayed as text when hovering over profile images. It's worth noting that the /userpix/ page is not linked to by default and its access is restricted.

Recommendations For moodle versions 3.1 to 3.1.15, update to a version later than 3.1.15 to resolve the issue. For moodle versions 3.4 to 3.4.6, update to a version later than 3.4.6 to resolve the issue. For moodle versions 3.5 to 3.5.3, update to a version later than 3.5.3 to resolve the issue. For moodle versions 3.6 to 3.6.1, update to a version later than 3.6.1 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-3810

GHSA-WM4W-8VC6-2J4H

Affected Products

Moodle

References · 13

• 🔥 https://github.com/farisv/Moodle-CVE-2019-3810 · Exploit
• 🔥 http://packetstormsecurity.com/files/162399/Moodle-3.6.1-Cross-Site-Scripting.html · Exploit
• 🔥 https://exploit-db.com/exploits/49814 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3810 · Security Note
• http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64372 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810 · Patch
• https://ubuntu.com/security/CVE-2019-3810 · Vendor Advisory
• https://moodle.org/mod/forum/discuss.php?d=381230#p1536767 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wm4w-8vc6-2j4h · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-3810 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3810 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3810 · Vendor Advisory
• https://github.com/moodle/moodle · Note