MitreCVE-2012-6037CVE-2012-6037
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
83.5%
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with “unknown fields,” which are not properly handled in error messages in the (1) bulk user, (2) group, and (3) group member upload capabilities. NOTE: this issue was originally part of CVE-2012-2243, but that ID was SPLIT due to different issues by different researchers.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| mahara | mahara | 1.4 | cpe:2.3:a:mahara:mahara:1.4:rc1:*:*:*:*:*:* |
| mahara | mahara | 1.4 | cpe:2.3:a:mahara:mahara:1.4:rc2:*:*:*:*:*:* |
| mahara | mahara | 1.4 | cpe:2.3:a:mahara:mahara:1.4:rc3:*:*:*:*:*:* |
| mahara | mahara | 1.4 | cpe:2.3:a:mahara:mahara:1.4:rc4:*:*:*:*:*:* |
| mahara | mahara | 1.4.0 | cpe:2.3:a:mahara:mahara:1.4.0:*:*:*:*:*:*:* |
| mahara | mahara | 1.4.1 | cpe:2.3:a:mahara:mahara:1.4.1:*:*:*:*:*:*:* |
| mahara | mahara | 1.4.2 | cpe:2.3:a:mahara:mahara:1.4.2:*:*:*:*:*:*:* |
| mahara | mahara | 1.4.3 | cpe:2.3:a:mahara:mahara:1.4.3:*:*:*:*:*:*:* |
| mahara | mahara | 1.4.4 | cpe:2.3:a:mahara:mahara:1.4.4:*:*:*:*:*:*:* |
| mahara | mahara | 1.5 | cpe:2.3:a:mahara:mahara:1.5:rc1:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
83.5%