CVE-2017-1000139

Published Nov 3, 2017

Last updated 7 years ago

Overview

Description
Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues.
Source
cve@mitre.org
NVD status
Analyzed

Risk scores

CVSS 3.0

Type
Primary
Base score
8
Impact score
5.9
Exploitability score
2.1
Vector string
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Severity
HIGH

CVSS 2.0

Type
Primary
Base score
6
Impact score
6.4
Exploitability score
6.8
Vector string
AV:N/AC:M/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov
CWE-918

Social media

Hype score
Not currently trending

Configurations