« Volver al listado

CVE-2013-1426

Estado: ModificadaMedia (6.1)—

Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mahara — Mahara

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-1426",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@debian.org",
      "affectedData": [
        {
          "vendor": "mahara",
          "product": "mahara",
          "versions": [
            {
              "status": "affected",
              "version": "1.5.9"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-07T21:15:10.533",
  "references": [
    {
      "url": "https://bugs.launchpad.net/mahara/+bug/1153423",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://mahara.org/interaction/forum/topic.php?id=5365",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://security-tracker.debian.org/tracker/CVE-2013-1426",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security@debian.org"
    },
    {
      "url": "https://bugs.launchpad.net/mahara/+bug/1153423",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://mahara.org/interaction/forum/topic.php?id=5365",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security-tracker.debian.org/tracker/CVE-2013-1426",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site Scripting (XSS) in Mahara before 1.5.9 and 1.6.x before 1.6.4 allows remote attackers to inject arbitrary web script or HTML via the TinyMCE editor."
    },
    {
      "lang": "es",
      "value": "Un ataque de tipo Cross-site Scripting (XSS) en Mahara versiones anteriores a 1.5.9 y versiones 1.6.x anteriores a 1.6.4, permite a atacantes remotos inyectar script web o HTML arbitrario por medio del editor TinyMCE."
    }
  ],
  "lastModified": "2026-06-16T23:51:24.940",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68DD3719-C6F9-4B33-8E84-78CE8053CD98",
              "versionEndExcluding": "1.5.9"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77A61F28-4EDC-4310-A7C6-C3A533358EE2",
              "versionEndExcluding": "1.6.4",
              "versionStartIncluding": "1.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@debian.org"
}