// For flags

CVE-2017-17454

 

Severity Score

5.4
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value.

Mahara 16.10 en versiones anteriores a la 16.10.7, versiones 17.04 anteriores a la 17.04.5 y versiones 17.10 anteriores a la 17.10.2 tiene una vulnerabilidad de Cross Site Scripting (XSS) cuando un usuario introduce caracteres UTF-8 no válidos. Estos serán descartados en Mahara junto con caracteres NULL y caracteres Unicode inválidos. Mahara también evitará el uso directo de $_GET y $_POST cuando sea posible; a su vez empleará param_exists() y la función correcta param_*() para recuperar el valor esperado.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-12-06 CVE Reserved
  • 2018-02-20 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mahara
Search vendor "Mahara"
 Mahara
Search vendor "Mahara" for product "Mahara"
 >= 16.10.0 < 16.10.7
Search vendor "Mahara" for product "Mahara" and version " >= 16.10.0 < 16.10.7"
-
Affected
Mahara
Search vendor "Mahara"
 Mahara
Search vendor "Mahara" for product "Mahara"
 >= 17.04.0 < 17.04.5
Search vendor "Mahara" for product "Mahara" and version " >= 17.04.0 < 17.04.5"
-
Affected
Mahara
Search vendor "Mahara"
 Mahara
Search vendor "Mahara" for product "Mahara"
 >= 17.10.0 < 17.10.2
Search vendor "Mahara" for product "Mahara" and version " >= 17.10.0 < 17.10.2"
-
Affected