Vulnerability Details : CVE-2012-2243
Cross-site scripting (XSS) vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web script or HTML by uploading an XML file with the xhtml extension, which is rendered inline as script. NOTE: this can be leveraged with CVE-2012-2244 to execute arbitrary code without authentication, as demonstrated by modifying the clamav path.
Vulnerability category: Cross site scripting (XSS)Execute code
Exploit prediction scoring system (EPSS) score for CVE-2012-2243
Probability of exploitation activity in the next 30 days: 0.98%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 81 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-2243
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2012-2243
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-2243
-
https://bugs.launchpad.net/mahara/+bug/1055232
Bug #1055232 “XSS using user uploaded XHTML files” : Bugs : Mahara
-
http://www.debian.org/security/2012/dsa-2591
Debian -- Security Information -- DSA-2591-1 mahara
-
https://mahara.org/interaction/forum/topic.php?id=4937
Security Announcements - Multiple Cross-site Scripting Vulnerabilities - Mahara ePortfolio SystemPatch;Vendor Advisory
Products affected by CVE-2012-2243
- cpe:2.3:a:mahara:mahara:1.4:rc2:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.4:rc3:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.4:rc4:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.5:rc2:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:mahara:mahara:1.5.3:*:*:*:*:*:*:*