CVE-2012-2239: Code Injection
First published: Sat Nov 24 2012(Updated: )
Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.
Credit: security@debian.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mahara | >=1.4.0<1.4.4 | |
| Mahara | >=1.5.0<1.5.3 | |
| Debian | =6.0 | |
| Mahara | =1.1.4 | |
| Mahara | =1.1.5 | |
| Mahara | =1.4-rc1 | |
| Mahara | =1.4-rc2 | |
| Mahara | =1.4-rc3 | |
| Mahara | =1.4-rc4 | |
| Mahara | =1.4.0 | |
| Mahara | =1.4.1 | |
| Mahara | =1.4.2 | |
| Mahara | =1.4.3 | |
| Mahara | =1.5-rc1 | |
| Mahara | =1.5-rc2 | |
| Mahara | =1.5.0 | |
| Mahara | =1.5.1 | |
| Mahara | =1.5.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-2239?
CVE-2012-2239 has a medium severity rating as it allows remote file reading through an XXE injection.
How do I fix CVE-2012-2239?
To fix CVE-2012-2239, upgrade Mahara to version 1.4.4 or later, or 1.5.3 or later.
What versions of Mahara are affected by CVE-2012-2239?
CVE-2012-2239 affects Mahara versions 1.4.0 to 1.4.3 and 1.5.0 to 1.5.2.
Can CVE-2012-2239 be exploited remotely?
Yes, CVE-2012-2239 can be exploited remotely by attackers to read arbitrary files.
What type of attack is CVE-2012-2239 associated with?
CVE-2012-2239 is associated with an XML external entity (XXE) injection attack.
- agent/type
- agent/severity
- agent/remedy
- agent/weakness
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/mahara
- canonical/mahara
- version/mahara/1.4.0
- version/mahara/1.5.0
- vendor/debian
- canonical/debian
- version/debian/6.0
- version/mahara/1.1.4
- version/mahara/1.1.5
- version/mahara/1.4-rc1
- version/mahara/1.4-rc2
- version/mahara/1.4-rc3
- version/mahara/1.4-rc4
- version/mahara/1.4.1
- version/mahara/1.4.2
- version/mahara/1.4.3
- version/mahara/1.5-rc1
- version/mahara/1.5-rc2
- version/mahara/1.5.1
- version/mahara/1.5.2