{"id":"CVE-2019-10134","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-10134","generatedAt":"2026-10-29T01:50:32.057Z","title":"The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.","description":"A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.","published":"2019-06-26T19:15:11.000Z","lastModified":"2026-06-17T02:10:20.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":3.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"},"cwe":["CWE-20"],"affected":["moodle/moodle"],"epss":{"score":0.0105,"percentile":0.64096,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.05%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10134","tags":["Issue Tracking","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"https://moodle.org/mod/forum/discuss.php?d=386524","tags":["Patch","Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10134","tags":["Issue Tracking","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://moodle.org/mod/forum/discuss.php?d=386524","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-10134","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}