CVE-2017-1000139

Published: Nov 3, 2017Modified: May 13, 2026

8.0

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: NVD

Description

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues.

Affected (21)

Products: Mahara: Mahara

Mahara

1 product

Mahara

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 1.8.0
Mahara Mahara	Version 1.8.1
Mahara Mahara	Version 1.8.2
Mahara Mahara	Version 1.8.3
Mahara Mahara	Version 1.8.4
Mahara Mahara	Version 1.8.5
Mahara Mahara	Version 1.8.6
Mahara Mahara	Version 1.8 rc1
Mahara Mahara	Version 1.8 rc2

Configuration B

6 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 1.9.0
Mahara Mahara	Version 1.9.1
Mahara Mahara	Version 1.9.2
Mahara Mahara	Version 1.9.3
Mahara Mahara	Version 1.9.4
Mahara Mahara	Version 1.9 rc1