CVE-2019-3810

2019-03-2500:00:00

CWE-79

redhat

www.cve.org

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

6 Medium

AI Score

Confidence

High

0.018 Low

EPSS

Percentile

88.4%

JSON

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users’ full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

CNA Affected

[
  {
    "vendor": "[UNKNOWN]",
    "product": "moodle",
    "versions": [
      {
        "version": "3.6.2",
        "status": "affected"
      },
      {
        "version": "3.5.4",
        "status": "affected"
      },
      {
        "version": "3.4.7",
        "status": "affected"
      },
      {
        "version": "3.1.16",
        "status": "affected"
      }
    ]
  }
]