CVE-2019-3810

CVSS 4.3 MEDIUMEPSS 13.9%CWE-79

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Produtos afetados

[UNKNOWN] · moodle

PoCs públicas encontradas — 3

githubgithub.com/farisv/Moodle-CVE-2019-3810★ 17 cve_referencepacketstormsecurity.com/files/162399/Moodle-3.6.1-Cross-Site-Scripting.htmlnão verificado exploitdbwww.exploit-db.com/exploits/49814não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64372 http://packetstormsecurity.com/files/162399/Moodle-3.6.1-Cross-Site-Scripting.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810 https://moodle.org/mod/forum/discuss.php?d=381230#p1536767