CVE-2017-1000139: SSRF
First published: Fri Nov 03 2017(Updated: )
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mahara Mahara | =1.8-rc1 | |
| Mahara Mahara | =1.8-rc2 | |
| Mahara Mahara | =1.8.0 | |
| Mahara Mahara | =1.8.1 | |
| Mahara Mahara | =1.8.2 | |
| Mahara Mahara | =1.8.3 | |
| Mahara Mahara | =1.8.4 | |
| Mahara Mahara | =1.8.5 | |
| Mahara Mahara | =1.8.6 | |
| Mahara Mahara | =1.9-rc1 | |
| Mahara Mahara | =1.9.0 | |
| Mahara Mahara | =1.9.1 | |
| Mahara Mahara | =1.9.2 | |
| Mahara Mahara | =1.9.3 | |
| Mahara Mahara | =1.9.4 | |
| Mahara Mahara | =1.10-rc1 | |
| Mahara Mahara | =1.10.0 | |
| Mahara Mahara | =1.10.1 | |
| Mahara Mahara | =1.10.2 | |
| Mahara Mahara | =15.04-rc1 | |
| Mahara Mahara | =15.04-rc2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this security issue?
The vulnerability ID is CVE-2017-1000139.
What is the severity level of CVE-2017-1000139?
The severity level of CVE-2017-1000139 is high (8).
How does CVE-2017-1000139 affect Mahara?
CVE-2017-1000139 affects Mahara versions 1.8 before 1.8.7, 1.9 before 1.9.5, 1.10 before 1.10.3, and 15.04 before 15.04.0.
What is the vulnerability description of CVE-2017-1000139?
CVE-2017-1000139 is a server-side request forgery vulnerability in Mahara that occurs when not all processes of curl redirects are checked against a white or black list.
How can I prevent server-side request forgery attacks on Mahara?
You can prevent server-side request forgery attacks on Mahara by employing SafeCurl.
- collector/nvd-index
- agent/references
- agent/severity
- agent/weakness
- agent/tags
- agent/type
- agent/event
- agent/author
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/mahara
- canonical/mahara mahara
- version/mahara mahara/1.8-rc1
- version/mahara mahara/1.8-rc2
- version/mahara mahara/1.8.0
- version/mahara mahara/1.8.1
- version/mahara mahara/1.8.2
- version/mahara mahara/1.8.3
- version/mahara mahara/1.8.4
- version/mahara mahara/1.8.5
- version/mahara mahara/1.8.6
- version/mahara mahara/1.9-rc1
- version/mahara mahara/1.9.0
- version/mahara mahara/1.9.1
- version/mahara mahara/1.9.2
- version/mahara mahara/1.9.3
- version/mahara mahara/1.9.4
- version/mahara mahara/1.10-rc1
- version/mahara mahara/1.10.0
- version/mahara mahara/1.10.1
- version/mahara mahara/1.10.2
- version/mahara mahara/15.04-rc1
- version/mahara mahara/15.04-rc2