CVE-2019-3810: Information Exposure

March 25, 2019 (updated October 9, 2019)

The /userpix/ page did not escape users’ full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

References

git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64372
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3810
moodle.org/mod/forum/discuss.php?d=381230
nvd.nist.gov/vuln/detail/CVE-2019-3810

Detect and mitigate CVE-2019-3810 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →