CVE-2019-3810

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-03-25 · updated 2026-06-17
Weakness: CWE-79

Description

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

Affected products

Moodle: from 3.1.0 through 3.1.15; from 3.4.0 through 3.4.6; from 3.5.0 through 3.5.3; from 3.6.0 through 3.6.1

References

http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64372
http://packetstormsecurity.com/files/162399/Moodle-3.6.1-Cross-Site-Scripting.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810
https://moodle.org/mod/forum/discuss.php?d=381230#p1536767
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64372
http://packetstormsecurity.com/files/162399/Moodle-3.6.1-Cross-Site-Scripting.html
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810
https://moodle.org/mod/forum/discuss.php?d=381230#p1536767

Get alerted when CVE-2019-3810 or the next vulnerability affects your stack