critical9.1
CVE-2012-2239
Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) inj…
Impact
Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mahara | Mahara | from 1.4.0 before 1.4.4 from 1.5.0 before 1.5.3 |
| Debian | Debian Linux | Version 6.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.debian.org/security/2012/dsa-2591
- https://bugs.launchpad.net/mahara/+bug/1047111
- https://mahara.org/interaction/forum/topic.php?id=4869
- http://www.debian.org/security/2012/dsa-2591
- https://bugs.launchpad.net/mahara/+bug/1047111
- https://mahara.org/interaction/forum/topic.php?id=4869