CVE-2017-1000149
medium
CVSS v3
5.4
CVSS v4 NEW
—
VIR risk
5.4
Description
Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="_blank" and window.open())
Predictions
Exploit likelihood
64%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| mahara | mahara | 15.10 | |
| mahara | mahara | 15.10.0 | |
| mahara | mahara | 15.10.1 | |
| mahara | mahara | 1.10 | |
| mahara | mahara | 1.10.0 | |
| mahara | mahara | 1.10.1 | |
| mahara | mahara | 1.10.2 | |
| mahara | mahara | 1.10.3 | |
| mahara | mahara | 1.10.4 | |
| mahara | mahara | 1.10.5 | |
| mahara | mahara | 1.10.6 | |
| mahara | mahara | 1.10.7 | |
| mahara | mahara | 1.10.8 | |
| mahara | mahara | 15.04 | |
| mahara | mahara | 15.04.0 | |
| mahara | mahara | 15.04.1 | |
| mahara | mahara | 15.04.2 | |
| mahara | mahara | 15.04.3 | |
| mahara | mahara | 15.04.4 | |
| mahara | mahara | 15.04.5 | |
References
CWEs
CWE-79
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.