Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Multiple security fixes. No longer uses bundled php-pear-CAS.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in mahara, an electronic portfolio, weblog, and resume builder. The following Common Vulnerabilities and Exposures project ids identify them :

  - CVE-2010-1667     Multiple pages performed insufficient input sanitising,     making them vulnerable to cross-site scripting attacks.

  - CVE-2010-1668     Multiple forms lacked protection against cross-site     request forgery attacks, therefore making them     vulnerable.

  - CVE-2010-1670     Gregor Anzelj discovered that it was possible to     accidentally configure an installation of mahara that     allows access to another user's account without a     password.

  - CVE-2010-2479     Certain Internet Explorer-specific cross-site scripting     vulnerabilities were discovered in HTML Purifier, of     which a copy is included in the mahara package.

ID	Name	Product	Family	Severity
48418	Fedora 14 : moodle-1.9.9-2.fc14 (2010-13396)	Nessus	Fedora Local Security Checks	medium
48394	Fedora 12 : moodle-1.9.9-2.fc12 (2010-13254)	Nessus	Fedora Local Security Checks	medium
48393	Fedora 13 : moodle-1.9.9-2.fc13 (2010-13250)	Nessus	Fedora Local Security Checks	medium
47589	Debian DSA-2067-1 : mahara - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2010-2479

medium

Tenable Plugins

medium

medium

medium

high