CVE-2012-2237: Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script…

PriorityP334medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EXPLOIT

EPSS

2.87%

85.0th percentile

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.3 and 1.5.x before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript innerHTML as used when generating login forms, (2) links or (3) resources URLs, and (4) the Display name in a user profile.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
mahara	mahara	—	—
mahara	mahara	>= 1.4.0 < 1.4.3	1.4.3
mahara	mahara	>= 1.5.0 < 1.5.2	1.5.2

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.