CVE-2012-2239

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-2239
Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.

9.1 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

6.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://www.debian.org/security/2012/dsa-2591 Mailing List
https://bugs.launchpad.net/mahara/+bug/1047111 Issue Tracking Patch
https://mahara.org/interaction/forum/topic.php?id=4869 Vendor Advisory
http://www.debian.org/security/2012/dsa-2591 Mailing List
https://bugs.launchpad.net/mahara/+bug/1047111 Issue Tracking Patch
https://mahara.org/interaction/forum/topic.php?id=4869 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
History

21 Nov 2024, 01:38

Type Values Removed Values Added
References () http://www.debian.org/security/2012/dsa-2591 - Mailing List () http://www.debian.org/security/2012/dsa-2591 - Mailing List
References () https://bugs.launchpad.net/mahara/+bug/1047111 - Issue Tracking, Patch () https://bugs.launchpad.net/mahara/+bug/1047111 - Issue Tracking, Patch
References () https://mahara.org/interaction/forum/topic.php?id=4869 - Vendor Advisory () https://mahara.org/interaction/forum/topic.php?id=4869 - Vendor Advisory

15 Feb 2024, 03:19

Type Values Removed Values Added
CWE CWE-94 CWE-611
CPE cpe:2.3:a:mahara:mahara:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.4.1:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.4:rc1:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.1.5:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.4:rc4:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.4.2:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.4.3:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.5:rc2:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.5.0:*:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.5:rc1:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.4:rc2:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.4:rc3:*:*:*:*:*:*
cpe:2.3:a:mahara:mahara:1.1.4:*:*:*:*:*:*:*		 cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*
CVSS v2 : 6.4
v3 : unknown 		v2 : 6.4
v3 : 9.1
First Time Debian debian Linux
Debian
References () http://www.debian.org/security/2012/dsa-2591 - () http://www.debian.org/security/2012/dsa-2591 - Mailing List
References () https://bugs.launchpad.net/mahara/+bug/1047111 - () https://bugs.launchpad.net/mahara/+bug/1047111 - Issue Tracking, Patch
Information

Published : 2012-11-24 20:55

Updated : 2025-04-11 00:51

NVD link : CVE-2012-2239

Mitre link : CVE-2012-2239

CVE.ORG link : CVE-2012-2239

JSON object : View

Products Affected

debian

  • debian_linux

mahara

  • mahara
CWE
CWE-611

Improper Restriction of XML External Entity Reference