Mahara 'groupviews.tpl' Cross Site Scripting Vulnerability

Bugtraq ID:	44705
Class:	Input Validation Error
CVE:	CVE-2010-3871
Remote:	Yes
Local:	No
Published:	Nov 08 2010 12:00AM
Updated:	Nov 08 2010 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Mahara Mahara 1.3.2 Mahara Mahara 1.3.1 Mahara Mahara 1.3.0
Not Vulnerable:	Mahara Mahara 1.3.3

Mahara 'groupviews.tpl' Cross Site Scripting Vulnerability

Mahara is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Mahara 1.3.3 are vulnerable.

Mahara 'groupviews.tpl' Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Mahara 'groupviews.tpl' Cross Site Scripting Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

Mahara 'groupviews.tpl' Cross Site Scripting Vulnerability

References:

• Mahara 1.3.3 Release Notes (Mahara)
  
• Mahara Homepage (Mahara)