CVE-2019-10134: Input Validation
First published: Wed Jun 26 2019(Updated: )
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/moodle/moodle | >=3.1<3.1.18 | 3.1.18 |
| composer/moodle/moodle | >=3.4<3.4.9 | 3.4.9 |
| composer/moodle/moodle | >=3.5<3.5.6 | 3.5.6 |
| composer/moodle/moodle | >=3.6<3.6.4 | 3.6.4 |
| Moodle | >=3.1.0<=3.1.17 | |
| Moodle | >=3.4.0<=3.4.8 | |
| Moodle | >=3.5.0<=3.5.5 | |
| Moodle | >=3.6.0<=3.6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-10134?
CVE-2019-10134 has a medium severity rating due to the potential for users to exceed their private file quota.
How do I fix CVE-2019-10134?
To fix CVE-2019-10134, upgrade Moodle to versions 3.1.18, 3.5.6, 3.6.4, 3.4.9, or later.
What versions of Moodle are affected by CVE-2019-10134?
CVE-2019-10134 affects Moodle versions before 3.7, 3.6.4, 3.5.6, 3.4.9, and 3.1.18.
What are the implications of CVE-2019-10134 for Moodle users?
The implications of CVE-2019-10134 include the risk of users being able to upload more files than their quota allows, potentially leading to resource exhaustion.
Is there a workaround for CVE-2019-10134?
There is no specific workaround for CVE-2019-10134; upgrading to the patched versions is recommended to mitigate the vulnerability.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-j8wr-7xxj-c2fr
- alias/CVE-2019-10134
- agent/software-canonical-lookup
- agent/severity
- agent/remedy
- agent/weakness
- agent/references
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- package-manager/composer
- vendor/moodle
- canonical/moodle
- version/moodle/3.1.0
- version/moodle/3.1.17
- version/moodle/3.4.0
- version/moodle/3.4.8
- version/moodle/3.5.0
- version/moodle/3.5.5
- version/moodle/3.6.0
- version/moodle/3.6.3