CVE-2017-17454
Summary
| CVE | CVE-2017-17454 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-02-20 22:29:00 UTC |
| Updated | 2018-03-16 14:37:00 UTC |
| Description | Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Announcements - Security issue relating to cross-site scripting <16.10.7; <17.04.5; <17.10.2 - Mahara ePortfolio System | CONFIRM | mahara.org | Vendor Advisory |
| Gerrit Code Review | CONFIRM | reviews.mahara.org | Vendor Advisory |
| Bug #1732987 “Fix user input from direct get post usage” : Bugs : Mahara | MISC | bugs.launchpad.net | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.