GitHub Advisoryadvisory · Packagist

GHSA-wm4w-8vc6-2j4h Moodle XSS Vulnerability

MEDIUM Published 2022-05-13 Modified 2023-09-28 Official page ↗
Aliases
CVE-2019-3810
Ecosystem
Packagist
Packages
moodle/moodle
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-79
Reviewed
2023-07-18

Affected packages

• Packagist moodle/moodle: >= 3.6.0, < 3.6.1 → fixed in 3.6.1 • Packagist moodle/moodle: >= 3.5.0, < 3.5.3 → fixed in 3.5.3 • Packagist moodle/moodle: >= 3.4.0, < 3.4.6 → fixed in 3.4.6 • Packagist moodle/moodle: >= 3.1.0, < 3.1.15 → fixed in 3.1.15

Description

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

Related

Alias · CVE (1)

  • CVE-2019-3810 A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References