CVE-2017-9551

moderate-risk

Published 2017-09-25

Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload, e.g. XSS code, to be saved as their name in the usr_registration table. The values are then emailed to the the user and administrator and if accepted become part of the new user's account.

Do I need to act?

0.28% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Mahara

Affected Vendors

Mahara

References (4)

Issue Tracking https://bugs.launchpad.net/mahara/+bug/1697308

Vendor Advisory https://mahara.org/interaction/forum/topic.php?id=8040

Issue Tracking https://bugs.launchpad.net/mahara/+bug/1697308

Vendor Advisory https://mahara.org/interaction/forum/topic.php?id=8040

/ 100

moderate-risk

Severity 23/34 · High

Exploitability 1/34 · Minimal

Exposure 24/34 · High