{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2019-04-30T00:00:00", "descriptions": [{"lang": "en", "value": "An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting (XSS) due to not escaping it when viewing the collection's SmartEvidence overview page (if that feature is turned on). This can be exploited by any logged-in user."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-05-07T13:58:24", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.launchpad.net/bugs/1819547"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://mahara.org/interaction/forum/topic.php?id=8446"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-9709", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting (XSS) due to not escaping it when viewing the collection's SmartEvidence overview page (if that feature is turned on). This can be exploited by any logged-in user."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugs.launchpad.net/bugs/1819547", "refsource": "CONFIRM", "url": "https://bugs.launchpad.net/bugs/1819547"}, {"name": "https://mahara.org/interaction/forum/topic.php?id=8446", "refsource": "CONFIRM", "url": "https://mahara.org/interaction/forum/topic.php?id=8446"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T21:54:45.092Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.launchpad.net/bugs/1819547"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://mahara.org/interaction/forum/topic.php?id=8446"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-9709", "datePublished": "2019-05-07T13:58:24", "dateReserved": "2019-03-11T00:00:00", "dateUpdated": "2024-08-04T21:54:45.092Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "matchCriteriaId": "2DFA9054-9C40-4415-B723-732BBB7E8C85", "versionEndExcluding": "17.10.8", "versionStartIncluding": "17.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "matchCriteriaId": "A60B16D5-4924-45E9-B71B-C8DF16C79360", "versionEndExcluding": "18.04.4", "versionStartIncluding": "18.04.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "matchCriteriaId": "00E63397-B5EF-485D-BA1A-6FDA3827C3AD", "versionEndExcluding": "18.10.1", "versionStartIncluding": "18.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting (XSS) due to not escaping it when viewing the collection's SmartEvidence overview page (if that feature is turned on). This can be exploited by any logged-in user."}, {"lang": "es", "value": "Fue encontrado un problema en Mahara versi\u00f3n 17.10 anterior de 17.10.8, versi\u00f3n 18.04 anterior de 18.04.4 y versi\u00f3n 18.10 anterior de 18.10.1. El t\u00edtulo collection es vulnerable a Cross Site Scripting (XSS) debido a que no escapa al ver la p\u00e1gina de informaci\u00f3n general de collection's SmartEvidence (si esa funci\u00f3n est\u00e1 activada). Esto puede ser explotado por cualquier usuario registrado."}], "id": "CVE-2019-9709", "lastModified": "2019-05-07T17:53:32.570", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-05-07T14:29:01.193", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugs.launchpad.net/bugs/1819547"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://mahara.org/interaction/forum/topic.php?id=8446"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}