Mahara CVE-2011-2771 RSS Feeds Cross Site Scripting Vulnerability

Bugtraq ID:	50539
Class:	Input Validation Error
CVE:	CVE-2011-2771
Remote:	Yes
Local:	No
Published:	Nov 04 2011 12:00AM
Updated:	Mar 19 2015 08:23AM
Credit:	Teemu Vesala
Vulnerable:	Mahara Mahara 1.3.6 Mahara Mahara 1.3.5 Mahara Mahara 1.3.4 Mahara Mahara 1.3.3 Mahara Mahara 1.3 beta3 Mahara Mahara 1.3 beta2 Mahara Mahara 1.3 beta1 Mahara Mahara 1.2.5 Mahara Mahara 1.2.4 Mahara Mahara 1.2.3 Mahara Mahara 1.2 RC1 Mahara Mahara 1.2 beta4 Mahara Mahara 1.2 beta3 Mahara Mahara 1.2 beta1 Mahara Mahara 1.2 Beta Mahara Mahara 1.1.9 Mahara Mahara 1.1.8 Mahara Mahara 1.1.7 Mahara Mahara 1.1.6 Mahara Mahara 1.1.5 Mahara Mahara 1.1.4 Mahara Mahara 1.1.3 Mahara Mahara 1.1.2 Mahara Mahara 1.1.1 Mahara Mahara 1.1 Beta4 Mahara Mahara 1.1 Beta3 Mahara Mahara 1.1 Beta2 Mahara Mahara 1.0.15 Mahara Mahara 1.0.14 Mahara Mahara 1.0.13 Mahara Mahara 1.0.12 Mahara Mahara 1.0.11 Mahara Mahara 1.0.10 Mahara Mahara 1.0.9 Mahara Mahara 1.0.8 Mahara Mahara 1.0.7 Mahara Mahara 1.0.6 Mahara Mahara 1.0.5 Mahara Mahara 1.0.4 Mahara Mahara 1.0.3 Mahara Mahara 1.0.2 Mahara Mahara 1.0.1 Mahara Mahara 1.0 Mahara Mahara 0.9.1 Mahara Mahara 0.9 Mahara Mahara 1.3.2 Mahara Mahara 1.3.1 Mahara Mahara 1.3.0 RC1 Mahara Mahara 1.3.0 Beta4 Mahara Mahara 1.3.0 Mahara Mahara 1.2.7 Mahara Mahara 1.2.6 Mahara Mahara 1.2.5 Mahara Mahara 1.2.2 Mahara Mahara 1.2.1 Mahara Mahara 1.2.0 Alpha3 Mahara Mahara 1.2.0 Alpha2 Mahara Mahara 1.2.0 Alpha1 Mahara Mahara 1.2.0 Mahara Mahara 1.1.0 Rc2 Mahara Mahara 1.1.0 Rc1 Mahara Mahara 1.1.0 Beta1 Mahara Mahara 1.1.0 Alpha3 Mahara Mahara 1.1.0 Alpha2 Mahara Mahara 1.1.0 Alpha1 Mahara Mahara 1.1.0 Mahara Mahara 1.1 Mahara Mahara 0.9.2 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Mahara Mahara 1.4.1

Mahara CVE-2011-2771 RSS Feeds Cross Site Scripting Vulnerability

Mahara is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Mahara 1.4.1 are vulnerable.

Mahara CVE-2011-2771 RSS Feeds Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Mahara CVE-2011-2771 RSS Feeds Cross Site Scripting Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

Mahara CVE-2011-2771 RSS Feeds Cross Site Scripting Vulnerability

References:

• [SECURITY] [DSA 2334-1] mahara security update (Full Disclosure)
  
• Mahara 1.4.1 Release Notes (Mahara)
  
• Mahara Homepage (Mahara)