CVE-2017-1000139: SSRF
Published Nov 3, 2017
·Updated
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues.
Affected Software
21 affected components
Mahara Mahara=1.8-rc1
Mahara Mahara=1.8-rc2
Mahara Mahara=1.8.0
Mahara Mahara=1.8.1
Mahara Mahara=1.8.2
Mahara Mahara=1.8.3
Mahara Mahara=1.8.4
Mahara Mahara=1.8.5
Mahara Mahara=1.8.6
Mahara Mahara=1.9-rc1
Mahara Mahara=1.9.0
Mahara Mahara=1.9.1
Mahara Mahara=1.9.2
Mahara Mahara=1.9.3
Mahara Mahara=1.9.4
Mahara Mahara=1.10-rc1
Mahara Mahara=1.10.0
Mahara Mahara=1.10.1
Mahara Mahara=1.10.2
Mahara Mahara=15.04-rc1
Mahara Mahara=15.04-rc2
Remediation
Patch Available
Event History
Nov 3, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID of this security issue?
The vulnerability ID is CVE-2017-1000139.
2
What is the severity level of CVE-2017-1000139?
The severity level of CVE-2017-1000139 is high (8).
3
How does CVE-2017-1000139 affect Mahara?
CVE-2017-1000139 affects Mahara versions 1.8 before 1.8.7, 1.9 before 1.9.5, 1.10 before 1.10.3, and 15.04 before 15.04.0.
4
What is the vulnerability description of CVE-2017-1000139?
CVE-2017-1000139 is a server-side request forgery vulnerability in Mahara that occurs when not all processes of curl redirects are checked against a white or black list.
5
How can I prevent server-side request forgery attacks on Mahara?
You can prevent server-side request forgery attacks on Mahara by employing SafeCurl.