{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-09-13T00:00:00", "descriptions": [{"lang": "en", "value": "Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2013-02-08T10:00:00", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"name": "DSA-2591", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2012/dsa-2591"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.launchpad.net/mahara/+bug/1047111"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://mahara.org/interaction/forum/topic.php?id=4869"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2012-2239", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "DSA-2591", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2012/dsa-2591"}, {"name": "https://bugs.launchpad.net/mahara/+bug/1047111", "refsource": "CONFIRM", "url": "https://bugs.launchpad.net/mahara/+bug/1047111"}, {"name": "https://mahara.org/interaction/forum/topic.php?id=4869", "refsource": "CONFIRM", "url": "https://mahara.org/interaction/forum/topic.php?id=4869"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:26:08.975Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-2591", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2012/dsa-2591"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.launchpad.net/mahara/+bug/1047111"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://mahara.org/interaction/forum/topic.php?id=4869"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2012-2239", "datePublished": "2012-11-24T20:00:00", "dateReserved": "2012-04-16T00:00:00", "dateUpdated": "2024-08-06T19:26:08.975Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "matchCriteriaId": "611F8B3B-24B5-48F5-8B00-34D963456F31", "versionEndExcluding": "1.4.4", "versionStartIncluding": "1.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "matchCriteriaId": "9347221B-9020-44E1-B9E7-13C95FBD8633", "versionEndExcluding": "1.5.3", "versionStartIncluding": "1.5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "036E8A89-7A16-411F-9D31-676313BB7244", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php."}, {"lang": "es", "value": "Mahara v1.4.x anterior a v1.4.4 y v1.5.x anterior a v1.5.3 permite a atacantes remotos leer archivos arbitrarios o crear conexiones TCP a trav\u00e9s de un ataque de inyecci\u00f3n en una entidad XML externa (XXE), como se demuestra por la lectura de config.php."}], "id": "CVE-2012-2239", "lastModified": "2024-02-15T03:19:58.853", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2012-11-24T20:55:02.087", "references": [{"source": "security@debian.org", "tags": ["Mailing List"], "url": "http://www.debian.org/security/2012/dsa-2591"}, {"source": "security@debian.org", "tags": ["Issue Tracking", "Patch"], "url": "https://bugs.launchpad.net/mahara/+bug/1047111"}, {"source": "security@debian.org", "tags": ["Vendor Advisory"], "url": "https://mahara.org/interaction/forum/topic.php?id=4869"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}