CVE-2017-17454

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-17454
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-17454.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2017-17454
Published
2018-02-20T22:29:00.223Z
Modified
2026-03-15T22:24:08.771005Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $GET and $POST usage where possible, and instead use paramexists() and the correct param*() function to fetch the expected value.

References

Affected packages

Git / github.com/maharaproject/mahara

Affected ranges

Type
GIT
Repo
https://github.com/maharaproject/mahara
Events
Introduced
2d4a3b547ca5aa058a975f870f21ddf64fc840db
Fixed
07d65ee9e2aec6a198371467ac7919e710ab0448
Introduced
c1b8e4e448228b12a674c205a7288389613271e7
Fixed
8d0b45c841df6d94d1c401e8efd3b6665a6fea59
Introduced
7e3e132425fc023eb85e66717284540d80bdacd1
Fixed
1c9cce2d0b3881e5323244e91be781ad7c85668c
Database specific 
{
    "versions": [
        {
            "introduced": "16.10.0"
        },
        {
            "fixed": "16.10.7"
        },
        {
            "introduced": "17.04.0"
        },
        {
            "fixed": "17.04.5"
        },
        {
            "introduced": "17.10.0"
        },
        {
            "fixed": "17.10.2"
        }
    ]
}

Affected versions

16.*
16.10.0_RELEASE
16.10.1_RELEASE
16.10.2_RELEASE
16.10.3_RELEASE
16.10.4_RELEASE
16.10.5_RELEASE
16.10.6_RELEASE
17.*
17.04.0_RELEASE
17.04.1_RELEASE
17.04.2_RELEASE
17.04.3_RELEASE
17.04.4_RELEASE
17.10.0_RELEASE
17.10.1_RELEASE

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-17454.json"