CVE-2012-2237
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms,…
Does this matter?
Lower severity and a low EPSS score (2.87%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile.
- CVSS 3.1
- 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 2.87% probability · 86th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mahara/mahara · debian/debian linux
- Source
- security@debian.org
References
- http://www.debian.org/security/2012/dsa-2540Third Party Advisory
- https://bugs.launchpad.net/mahara/+bug/1009774Exploit, Third Party Advisory
- https://bugs.launchpad.net/mahara/+bug/1009777Exploit, Third Party Advisory
- https://bugs.launchpad.net/mahara/+bug/1009784Exploit, Patch, Third Party Advisory
- https://mahara.org/interaction/forum/topic.php?id=4748Patch, Vendor Advisory
- http://www.debian.org/security/2012/dsa-2540Third Party Advisory
- https://bugs.launchpad.net/mahara/+bug/1009774Exploit, Third Party Advisory
- https://bugs.launchpad.net/mahara/+bug/1009777Exploit, Third Party Advisory
- https://bugs.launchpad.net/mahara/+bug/1009784Exploit, Patch, Third Party Advisory
- https://mahara.org/interaction/forum/topic.php?id=4748Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.