Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Mahara can run malicious code via bad characters

CVE-2017-17454 · published 8 years ago
Summary

Versions of Mahara before 16.10.7, 17.04.5, and 17.10.2 may let an attacker inject harmful script when someone submits malformed text. This could let a malicious user run code in another user's browser, potentially stealing information or altering what they see. Update Mahara to the latest patch level to have the unsafe characters filtered out and safe input handling applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mahara mahara >= 16.10.0, < 16.10.7
>= 17.04.0, < 17.04.5
>= 17.10.0, < 17.10.2
cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*
Original advisory text
Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be ...
Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published20 Feb 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-17454 · NVD
Track software like this
Free during beta