Vulnerability Name:

CVE-2021-43265 (CCN-212680)

Assigned:2021-09-22
Published:2021-09-22
Updated:2021-11-09
Summary:In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element.
CVSS v3 Severity:5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
8.2 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N)
7.8 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
6.6 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2021-43265

Source: CCN
Type: Launchpad Bug #1944633
Stored cross site scripting in all tags input

Source: MISC
Type: Exploit, Third Party Advisory
https://bugs.launchpad.net/mahara/+bug/1944633

Source: XF
Type: UNKNOWN
mahara-cve202143265-xss(212680)

Source: CCN
Type: Mahara Web site
Mahara

Source: MISC
Type: Vendor Advisory
https://mahara.org/interaction/forum/topic.php?id=8953

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mahara:mahara:*:*:*:*:*:*:*:* (Version >= 20.04.0 and < 20.04.5)
  • OR cpe:/a:mahara:mahara:*:*:*:*:*:*:*:* (Version >= 20.10.0 and < 20.10.3)
  • OR cpe:/a:mahara:mahara:*:*:*:*:*:*:*:* (Version >= 21.04.0 and < 21.04.2)

    • Configuration CCN 1:
  • cpe:/a:mahara:mahara:20.04:rc1:*:*:*:*:*:*
  • OR cpe:/a:mahara:mahara:20.10:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    mahara mahara *
    mahara mahara *
    mahara mahara *
    mahara mahara 20.04 rc1
    mahara mahara 20.10