CVE-2012-2239 Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading...
CriticalCVSS 9.1
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mahara | >= 1.4.0, < 1.4.4 | 1.4.4 |
| mahara | >= 1.5.0, < 1.5.3 | 1.5.3 |
| debian linux | = 6.0 | No fix listed |
References
- DSA-2591 mailing-list vendor-advisory
- bugs.launchpad.net issue-tracking patch
- mahara.org vendor-advisory