CVE-2017-1000148 : Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 ar

Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file.

Published 2017-11-03 18:29:01

Updated 2019-10-03 00:03:26

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2017-1000148

Mahara » Mahara » Version: 15.04 Update RC2
cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04 Update RC1
cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04.0
cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04.1
cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04.5
cpe:2.3:a:mahara:mahara:15.04.5:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04.7
cpe:2.3:a:mahara:mahara:15.04.7:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04.2
cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04.3
cpe:2.3:a:mahara:mahara:15.04.3:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04.4
cpe:2.3:a:mahara:mahara:15.04.4:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.04.6
cpe:2.3:a:mahara:mahara:15.04.6:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 16.04 Update RC2
cpe:2.3:a:mahara:mahara:16.04:rc2:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 16.04.1
cpe:2.3:a:mahara:mahara:16.04.1:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 16.04 Update RC1
cpe:2.3:a:mahara:mahara:16.04:rc1:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 16.04.0
cpe:2.3:a:mahara:mahara:16.04.0:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.10.3
cpe:2.3:a:mahara:mahara:15.10.3:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.10.0
cpe:2.3:a:mahara:mahara:15.10.0:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.10.1
cpe:2.3:a:mahara:mahara:15.10.1:*:*:*:*:*:*:*
Matching versions
Mahara » Mahara » Version: 15.10.2
cpe:2.3:a:mahara:mahara:15.10.2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-1000148

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 47 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-1000148

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-1000148

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-1000148

https://bugs.launchpad.net/mahara/+bug/1508684

Bug #1508684 “Unserialize untrusted data when importing skins” : Bugs : Mahara
Issue Tracking;Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2017-1000148

Products affected by CVE-2017-1000148

Exploit prediction scoring system (EPSS) score for CVE-2017-1000148

CVSS scores for CVE-2017-1000148

CWE ids for CVE-2017-1000148

References for CVE-2017-1000148