CVE-2009-0664

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the introduction field in a user profile or (2) an arbitrary text block in a user view.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://mahara.org/interaction/forum/topic.php?id=532
http://osvdb.org/53891
http://osvdb.org/53892
http://secunia.com/advisories/34789	Vendor Advisory
http://secunia.com/advisories/34871
http://www.debian.org/security/2009/dsa-1778	Vendor Advisory
http://www.securityfocus.com/bid/34677	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mahara:mahara:1.0.0:::::::*
	cpe:2.3:a:mahara:mahara:1.0.1:::::::*
	cpe:2.3:a:mahara:mahara:1.0.2:::::::*
	cpe:2.3:a:mahara:mahara:1.0.3:::::::*
	cpe:2.3:a:mahara:mahara:1.0.4:::::::*
	cpe:2.3:a:mahara:mahara:1.0.5:::::::*
	cpe:2.3:a:mahara:mahara:1.0.6:::::::*
	cpe:2.3:a:mahara:mahara:1.0.7:::::::*
	cpe:2.3:a:mahara:mahara:1.0.8:::::::*
	cpe:2.3:a:mahara:mahara:1.0.9:::::::*
	cpe:2.3:a:mahara:mahara:1.0.10:::::::*
	cpe:2.3:a:mahara:mahara:1.1.0:alpha1::::::
	cpe:2.3:a:mahara:mahara:1.1.0:alpha2::::::
	cpe:2.3:a:mahara:mahara:1.1.0:alpha3::::::
	cpe:2.3:a:mahara:mahara:1.1.0:beta1::::::
	cpe:2.3:a:mahara:mahara:1.1.0:beta2::::::
	cpe:2.3:a:mahara:mahara:1.1.0:beta3::::::
	cpe:2.3:a:mahara:mahara:1.1.0:beta4::::::
	cpe:2.3:a:mahara:mahara:1.1.0:rc1::::::
	cpe:2.3:a:mahara:mahara:1.1.0:rc2::::::
	cpe:2.3:a:mahara:mahara:1.1.1:::::::*
	cpe:2.3:a:mahara:mahara:1.1.2:::::::*

History

No history.

Information

Published : 2009-04-23 17:30

Updated : 2024-02-04 17:33

NVD link : CVE-2009-0664

Mitre link : CVE-2009-0664

CVE.ORG link : CVE-2009-0664

JSON object : View

Products Affected

mahara

mahara

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2009-0664", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-04-23T17:30:01.670", "references": [{"url": "http://mahara.org/interaction/forum/topic.php?id=532", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/53891", "source": "cve@mitre.org"}, {"url": "http://osvdb.org/53892", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34789", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/34871", "source": "cve@mitre.org"}, {"url": "http://www.debian.org/security/2009/dsa-1778", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/34677", "tags": ["Patch"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the introduction field in a user profile or (2) an arbitrary text block in a user view."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Mahara la v1.0.x anteriores a v1.0.11 y la v1.1.x anteriores a v1.1.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML de forma arbitraria a trav\u00e9s (1) el campo \"introduction\" en el perfil de usuario o (2) un bloque de texto arbitrario en la vista de usuario."}], "lastModified": "2009-04-29T05:28:36.063", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B49D797-AF1B-4F7E-A71D-AABD0F802912"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18048333-3E64-4AB4-9F20-2B1B8E7AB9FE"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68167317-977B-48EE-9320-2A4539A93B29"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB25DF09-D88F-4633-9956-D64E3497153F"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E32430EE-5F2B-4936-A297-2DF55CC22937"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1CC0259C-E628-4BBA-9D97-41A130B1E741"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "974F2D63-488C-41D7-A627-BF9B085A8D10"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E26420D4-20D8-4D6D-88B5-C74F39B88720"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "321475F4-1548-4FD1-BED9-12D944388FD8"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F37005DE-BB31-4738-AC49-C3C2022AE8F1"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.0.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FA6F03B-F449-424E-A856-5BE5FB98814F"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84652E40-1C88-438D-BCA1-4FF4C069F9AC"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:alpha2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08F53776-5F58-4C20-8FE7-9DF06F1704A7"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:alpha3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5D55D2C-E6E5-44A4-831A-3EAE5C1568CF"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79228F92-00A8-4B74-A914-11BDF9641F6C"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EEB3BF7-C4D3-4BB8-893F-B0FE252F0405"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BE91ED4-EA2A-4402-813C-1A2E5B10EA40"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F7FB1F02-A03F-45E5-8D26-C007C10EE97D"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A09C63AC-15A8-4722-B18E-98A86EC8A856"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62452677-EE4C-4E5E-9DD2-D11C4211DA54"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FDC6F32-24C0-4B5E-8338-FF85B0BBF801"}, {"criteria": "cpe:2.3:a:mahara:mahara:1.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92848F08-EBFC-4579-A088-EC15D0B3EE48"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}