CVE-2019-3810

Name of the Vulnerable Software and Affected Versions moodle versions 3.1 to 3.1.15 moodle versions 3.4 to 3.4.6 moodle versions 3.5 to 3.5.3 moodle versions 3.6 to 3.6.1

Description A flaw was found in the software where the /userpix/ page did not properly escape users' full names. These names are displayed as text when hovering over profile images. It's worth noting that the /userpix/ page is not linked to by default and its access is restricted.

Recommendations For moodle versions 3.1 to 3.1.15, update to a version later than 3.1.15 to resolve the issue. For moodle versions 3.4 to 3.4.6, update to a version later than 3.4.6 to resolve the issue. For moodle versions 3.5 to 3.5.3, update to a version later than 3.5.3 to resolve the issue. For moodle versions 3.6 to 3.6.1, update to a version later than 3.6.1 to resolve the issue.