CVE-2017-1000149: XSS
Published Nov 3, 2017
·Updated
Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="blank" and window.open())
Affected Software
22 affected components
Mahara Mahara=15.10-rc1
Mahara Mahara=15.10-rc2
Mahara Mahara=15.10.0
Mahara Mahara=15.10.1
Mahara Mahara=1.10-rc1
Mahara Mahara=1.10.0
Mahara Mahara=1.10.1
Mahara Mahara=1.10.2
Mahara Mahara=1.10.3
Mahara Mahara=1.10.4
Mahara Mahara=1.10.5
Mahara Mahara=1.10.6
Mahara Mahara=1.10.7
Mahara Mahara=1.10.8
Mahara Mahara=15.04-rc1
Mahara Mahara=15.04-rc2
Mahara Mahara=15.04.0
Mahara Mahara=15.04.1
Mahara Mahara=15.04.2
Mahara Mahara=15.04.3
Mahara Mahara=15.04.4
Mahara Mahara=15.04.5
Remediation
Patch Available
Event History
Nov 3, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2017-1000149.
2
What is the severity of CVE-2017-1000149?
The severity of CVE-2017-1000149 is medium, with a severity value of 5.4.
3
Which versions of Mahara are affected by CVE-2017-1000149?
Mahara 1.10 before 1.10.9, 15.04 before 15.04.6, and 15.10 before 15.10.2 are affected.
4
What is the vulnerability in Mahara related to?
The vulnerability in Mahara is related to cross-site scripting (XSS) due to the use of window.opener (target="_blank" and window.open()).
5
Where can I find more information about CVE-2017-1000149?
More information about CVE-2017-1000149 can be found at the following link: [https://bugs.launchpad.net/mahara/+bug/1558361](https://bugs.launchpad.net/mahara/+bug/1558361)