What is CVE-2017-1000144?

CVE-2017-1000144 is a medium-severity vulnerability in Mahara, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2017-11-03.

How severe is CVE-2017-1000144?

Medium severity. CVSS v3 base score is 4.8 out of 10.

XSS in Mahara

CVE-2017-1000144

Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.005 (39.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N.

Affected products

Mahara — versions 1.9, 1.9.0, 1.9.1
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (Exploit, Patch, Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2017-1000144?: CVE-2017-1000144 is a medium-severity vulnerability in Mahara, classified under Cross-site Scripting. CVSS score: 4.8/10. Published 2017-11-03.
How severe is CVE-2017-1000144?: Medium severity. CVSS v3 base score is 4.8 out of 10.