CVE-2012-6037: XSS

Published Nov 24, 2012

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the (1) bulk user, (2) group, and (3) group member upload capabilities. NOTE: this issue was originally part of CVE-2012-2243, but that ID was SPLIT due to different issues by different researchers.

Affected Software

15 affected components

Mahara Mahara=1.4-rc1

Mahara Mahara=1.4-rc2

Mahara Mahara=1.4-rc3

Mahara Mahara=1.4-rc4

Mahara Mahara=1.4.0

Mahara Mahara=1.4.1

Mahara Mahara=1.4.2

Mahara Mahara=1.4.3

Mahara Mahara=1.4.4

Mahara Mahara=1.5-rc1

Mahara Mahara=1.5-rc2

Mahara Mahara=1.5.0

Mahara Mahara=1.5.1

Mahara Mahara=1.5.2

Mahara Mahara=1.5.3

Remediation

Patch Available

https://mahara.org/interaction/forum/topic.php?id=4937

Event History

Nov 24, 2012

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-6037?

CVE-2012-6037 is considered a medium severity vulnerability due to the potential for cross-site scripting attacks.

How do I fix CVE-2012-6037?

To fix CVE-2012-6037, upgrade Mahara to version 1.4.5 or 1.5.4 or later.

What versions of Mahara are affected by CVE-2012-6037?

CVE-2012-6037 affects Mahara versions 1.4.x before 1.4.5, 1.5.x before 1.5.4, and earlier versions including 1.2.

What type of attack does CVE-2012-6037 enable?

CVE-2012-6037 enables remote attackers to conduct cross-site scripting (XSS) attacks.

What components of Mahara does CVE-2012-6037 impact?

CVE-2012-6037 impacts the handling of CSV headers with unknown fields in error messages within Mahara.