« Volver al listado

CVE-2012-6037

Estado: ModificadaMedia (4.3)—

Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the (1) bulk user, (2) group, and (3) group member upload capabilities. NOTE: this issue was originally part of CVE-2012-2243, but that ID was SPLIT due to different issues by different researchers.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mahara — Mahara

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-6037",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-11-24T20:55:04.367",
  "references": [
    {
      "url": "http://www.debian.org/security/2012/dsa-2591",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.launchpad.net/mahara/+bug/1063480",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://mahara.org/interaction/forum/topic.php?id=4937",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.debian.org/security/2012/dsa-2591",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/mahara/+bug/1063480",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://mahara.org/interaction/forum/topic.php?id=4937",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with \"unknown fields,\" which are not properly handled in error messages in the (1) bulk user, (2) group, and (3) group member upload capabilities.  NOTE: this issue was originally part of CVE-2012-2243, but that ID was SPLIT due to different issues by different researchers."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Mahara v1.4.x anterior a v1.4.5 y v1.5.x anterior a v1.5.4, y otras versiones incluida la v1.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de una cabecera CSV con \"unknown fields,\" el cual no es correctamente manejado en mensajes de error en las propiedades de (1) user, (2) grupo y (3) miembro de grupo. NOTA: esta vulnerabilidad fue en un principio parte del CVE-2012-2243, pero dicho ID fue dividido debido a diferentes asuntos con diferentes investigadores."
    }
  ],
  "lastModified": "2026-06-16T23:47:42.133",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E59B9197-F3A7-48FE-B4EB-66E77477F119"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76ADB798-ECDF-400A-812B-8DA40DE652B1"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "621775F5-0256-4D4E-8F75-74F116029346"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "06BD6041-32C5-4470-A710-E8ACDD90A719"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E564972A-F44F-4935-BE50-8CB8A3F6483A"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A782949D-9F8D-4852-AA20-5E866C895CEB"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E05D9E1E-E2EE-43C4-993A-F140B83493AA"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF97D77B-B448-407C-A545-F939C1C75B4C"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.4.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A1DE181-B75C-49B1-AA87-0F0BA090E23B"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.5:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78E1C65F-C3F8-41B3-BFE5-9DB40B0FF7C9"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.5:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DB9744B-7694-41D9-B1A7-184AF5B90B9D"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DF1351BA-7AF2-4675-9BC3-6AB9786A361D"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1ECA8058-4E47-45CC-98FB-66F1635D4EB4"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82CA353E-6A25-4170-B32C-E06F0FFC0AE8"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:1.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DACA0DE-26D8-41C8-92DE-63CC348C6BB7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}