CVE-2012-2237 EXPLOIT
6.1
MEDIUM · CVSS 3.1 · EPSS 2.9% (pctl 86)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile.
Scoring
| CVSS | 6.1 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 2.87% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-79 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2019-12-17 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| debian | debian linux |
| mahara | mahara |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Mahara 1.4.1 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities | 2012-08-02 |
References
- http://www.debian.org/security/2012/dsa-2540
- https://bugs.launchpad.net/mahara/+bug/1009774
- https://bugs.launchpad.net/mahara/+bug/1009777
- https://bugs.launchpad.net/mahara/+bug/1009784
- https://mahara.org/interaction/forum/topic.php?id=4748
- http://www.debian.org/security/2012/dsa-2540
- https://bugs.launchpad.net/mahara/+bug/1009774
- https://bugs.launchpad.net/mahara/+bug/1009777
- https://bugs.launchpad.net/mahara/+bug/1009784
- https://mahara.org/interaction/forum/topic.php?id=4748
→ the Explorer · watch your stack · NVD