What is CVE-2017-9551?

CVE-2017-9551 is a medium-severity vulnerability in Mahara, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-09-25.

How severe is CVE-2017-9551?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Mahara

CVE-2017-9551

Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload, e.g. XSS code, to be saved as their name in the usr_registration table. The values are then emailed to the the user and administrator and if accepted become part of the new user's account.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (47.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Mahara — versions 15.04, 15.04.0, 15.04.1
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2017-9551?: CVE-2017-9551 is a medium-severity vulnerability in Mahara, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-09-25.
How severe is CVE-2017-9551?: Medium severity. CVSS v3 base score is 6.1 out of 10.