CVE-2017-1000140

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .xml file that can have its code executed when user tries to download the file.
References
Link Resource
https://bugs.launchpad.net/mahara/+bug/1404117 Exploit Issue Tracking Patch Third Party Advisory
Advertisement

NeevaHost hosting service

Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mahara:mahara:1.8:rc2:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.8.6:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.8.2:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.8.4:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.8.0:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.8:rc1:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.8.3:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.8.5:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:mahara:mahara:1.9:rc1:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.1:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.3:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.4:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.2:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:mahara:mahara:1.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10.2:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10:rc1:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*

Information

Published : 2017-11-03 11:29

Updated : 2017-11-15 06:10


NVD link : CVE-2017-1000140

Mitre link : CVE-2017-1000140


JSON object : View

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

dedicated server usa

Products Affected

mahara

  • mahara