Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2017-1000147

Опубликовано: 03 нояб. 2017
Источник: nvd
CVSS3: 6.8
CVSS2: 6
EPSS Низкий

Описание

Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mahara:mahara:1.9:rc1:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.1:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.2:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.3:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.4:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.5:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.6:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.9.7:*:*:*:*:*:*:*
Конфигурация 2

Одно из

cpe:2.3:a:mahara:mahara:1.10:rc1:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10.0:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10.1:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10.2:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10.3:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10.4:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.10.5:*:*:*:*:*:*:*
Конфигурация 3

Одно из

cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:*

EPSS

Процентиль: 29%
0.00104
Низкий

6.8 Medium

CVSS3

6 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

debian логотип

CVE-2017-1000147

CVSS3: 6.8
debian
больше 8 лет назад

Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04. ...

github логотип

GHSA-98v5-fr36-cc8r

CVSS3: 6.8
github
больше 3 лет назад

Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. This could allow an attacker to trick a Mahara user into unknowingly uploading malicious files into their Mahara account.

EPSS

Процентиль: 29%
0.00104
Низкий

6.8 Medium

CVSS3

6 Medium

CVSS2

Дефекты

CWE-352