CVE-2017-1000148
Summary
| CVE | CVE-2017-1000148 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-11-03 18:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file. |
Risk And Classification
Primary CVSS: v3.0 8.8 HIGH from [email protected]
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-502 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 8.8 | HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:S/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mahara | Mahara | 15.04 | rc1 | All | All |
| Application | Mahara | Mahara | 15.04 | rc2 | All | All |
| Application | Mahara | Mahara | 15.04.0 | All | All | All |
| Application | Mahara | Mahara | 15.04.1 | All | All | All |
| Application | Mahara | Mahara | 15.04.2 | All | All | All |
| Application | Mahara | Mahara | 15.04.3 | All | All | All |
| Application | Mahara | Mahara | 15.04.4 | All | All | All |
| Application | Mahara | Mahara | 15.04.5 | All | All | All |
| Application | Mahara | Mahara | 15.04.6 | All | All | All |
| Application | Mahara | Mahara | 15.04.7 | All | All | All |
| Application | Mahara | Mahara | 15.10.0 | All | All | All |
| Application | Mahara | Mahara | 15.10.1 | All | All | All |
| Application | Mahara | Mahara | 15.10.2 | All | All | All |
| Application | Mahara | Mahara | 15.10.3 | All | All | All |
| Application | Mahara | Mahara | 16.04 | rc1 | All | All |
| Application | Mahara | Mahara | 16.04 | rc2 | All | All |
| Application | Mahara | Mahara | 16.04.0 | All | All | All |
| Application | Mahara | Mahara | 16.04.1 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug #1508684 “Unserialize untrusted data when importing skins” : Bugs : Mahara | af854a3a-2127-422b-91ae-364da2661108 | bugs.launchpad.net | Issue Tracking, Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.