CVE-2017-1000147

Published: Nov 3, 2017Modified: May 13, 2026

6.8

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account.

Affected (21)

Products: Mahara: Mahara

Mahara

1 product

Mahara

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 1.9.0
Mahara Mahara	Version 1.9.1
Mahara Mahara	Version 1.9.2
Mahara Mahara	Version 1.9.3
Mahara Mahara	Version 1.9.4
Mahara Mahara	Version 1.9.5
Mahara Mahara	Version 1.9.6
Mahara Mahara	Version 1.9.7
Mahara Mahara	Version 1.9 rc1

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 1.10.0
Mahara Mahara	Version 1.10.1
Mahara Mahara	Version 1.10.2
Mahara Mahara	Version 1.10.3
Mahara Mahara	Version 1.10.4
Mahara Mahara	Version 1.10.5
Mahara Mahara	Version 1.10 rc1

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 15.04.0
Mahara Mahara	Version 15.04.1
Mahara Mahara	Version 15.04.2
Mahara Mahara	Version 15.04 rc1
Mahara Mahara	Version 15.04 rc2

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://bugs.launchpad.net/mahara/+bug/1480329

Source: cve@mitre.org

ExploitIssue TrackingMitigationPatch

https://bugs.launchpad.net/mahara/+bug/1480329

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingMitigationPatch

Timeline

No history available yet.