CVE-2017-1000139 - Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list

Back Back to CVE browser

HIGH

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list

Published Nov 3, 2017

8.0

HIGH

CVSS 3.0

EPSS 0.72%

Description

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-918

SSRF

References (2)

https://bugs.launchpad.net/mahara/+bug/1397736
x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1424
Advisory

Link	Providers	Tags
https://bugs.launchpad.net/mahara/+bug/1397736		x_refsource_MISCIssue TrackingPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1424		Advisory