Moodle up to 3.1.15/3.4.6/3.5.3/3.6.1 /userpix/ Profile Image information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, was found in Moodle up to 3.1.15/3.4.6/3.5.3/3.6.1. The affected element is an unknown function of the file /userpix/. The manipulation as part of Profile Image results in information disclosure. This vulnerability is cataloged as CVE-2019-3810. The attack may be launched remotely. Furthermore, there is an exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Moodle up to 3.1.15/3.4.6/3.5.3/3.6.1 (Learning Management Software). Affected is some unknown functionality of the file /userpix/. The manipulation as part of a Profile Image leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.

The bug was discovered 01/21/2019. The weakness was shared 03/25/2019 as confirmed git commit (GIT Repository). The advisory is shared for download at git.moodle.org. This vulnerability is traded as CVE-2019-3810 since 01/03/2019. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1592.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 10 days. During that time the estimated underground price was around $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 121487 (Fedora 28 : moodle (2019-077cd6f168)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 277593 (Fedora Security Update for moodle (FEDORA-2019-077cd6f168)).

Upgrading eliminates this vulnerability. A possible mitigation has been published even before and not after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (49814) and Tenable (121487). The entries VDB-132202 and VDB-132203 are related to this item. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Learning Management Software

Name

• Moodle

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 3.1.9
• 3.1.10
• 3.1.11
• 3.1.12
• 3.1.13
• 3.1.14
• 3.1.15
• 3.4.0
• 3.4.1
• 3.4.2
• 3.4.3
• 3.4.4
• 3.4.5
• 3.4.6
• 3.5.0
• 3.5.1
• 3.5.2
• 3.5.3
• 3.6.0
• 3.6.1

License

• open-source

Website

• Product: https://moodle.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion