// For flags

CVE-2018-11196

 

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 can be used as medium to transmit viruses by placing infected files into a Leap2A archive and uploading that to Mahara. In contrast to other ZIP files that are uploaded, ClamAV (when activated) does not check Leap2A archives for viruses, allowing malicious files to be available for download. While files cannot be executed on Mahara itself, Mahara can be used to transfer such files to user computers.

Mahara, en versiones 17.04 anteriores a la 17.04.8, versiones 17.10 anteriores a la 17.10.5 y versiones 18.04 anteriores a la 18.04.1 pueden empelarse para transmitir virus colocando archivos infectados en un archivo Leap2A y subiéndolo a Mahara. En contraste con otros archivos ZIP que se suben, ClamAV (cuando se activa) no comprueba los archivos Leap2A en busca de virus, lo que permite que los archivos maliciosos estén disponibles para su descarga. Cuando los archivos no se pueden ejecutar en el propio Mahara, Mahara puede emplearse para transferir tales archivos a los ordenadores de los usuarios.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-05-16 CVE Reserved
  • 2018-06-01 CVE Published
  • 2024-04-10 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-434: Unrestricted Upload of File with Dangerous Type
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Mahara
Search vendor "Mahara"
 Mahara
Search vendor "Mahara" for product "Mahara"
 >= 17.04.0 < 17.04.8
Search vendor "Mahara" for product "Mahara" and version " >= 17.04.0 < 17.04.8"
-
Affected
Mahara
Search vendor "Mahara"
 Mahara
Search vendor "Mahara" for product "Mahara"
 >= 17.10.0 < 17.10.5
Search vendor "Mahara" for product "Mahara" and version " >= 17.10.0 < 17.10.5"
-
Affected
Mahara
Search vendor "Mahara"
 Mahara
Search vendor "Mahara" for product "Mahara"
 18.04.0
Search vendor "Mahara" for product "Mahara" and version "18.04.0"
-
Affected