CVE-2012-2237

moderate-risk
Published 2019-12-17

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile.

Do I need to act?

~
5.6% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
37565
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Debian Mahara

References (10)

Third Party Advisory http://www.debian.org/security/2012/dsa-2540
Exploit https://bugs.launchpad.net/mahara/+bug/1009774
Exploit https://bugs.launchpad.net/mahara/+bug/1009777
Exploit https://bugs.launchpad.net/mahara/+bug/1009784
Patch https://mahara.org/interaction/forum/topic.php?id=4748
Third Party Advisory http://www.debian.org/security/2012/dsa-2540
Exploit https://bugs.launchpad.net/mahara/+bug/1009774
Exploit https://bugs.launchpad.net/mahara/+bug/1009777
Exploit https://bugs.launchpad.net/mahara/+bug/1009784
Patch https://mahara.org/interaction/forum/topic.php?id=4748
46
/ 100
moderate-risk
Severity 23/34 · High
Exploitability 16/34 · Moderate
Exposure 7/34 · Low