Advisory details:
github_osv / GHSA-wm4w-8vc6-2j4h
| Advisory ID | github_osv/GHSA-wm4w-8vc6-2j4h |
| Aliases |
CVE-2019-3810
|
| Summary | Moodle XSS Vulnerability A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 4.8 |
| Risk | 9.6 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 5.3 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-wm4w-8vc6-2j4h/GHSA-wm4w-8vc6-2j4h.json |
| generic_textual | MODERATE |
| Data source | Exploit-DB |
|---|---|
| Date added | April 30, 2021 |
| Description | Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS) |
| Ransomware campaign use | Unknown |
| Source publication date | April 30, 2021 |
| Exploit type | webapps |
| Platform | php |
| Source update date | April 30, 2021 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.