PT-2021-10828 · Catalyst It · Mahara Cms

Published 2021-10-22 · Updated 2021-10-28 · CVE-2020-23052

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Catalyst IT Ltd Mahara CMS version 19.10.2

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities found in the groupfiles.php component. These vulnerabilities can be exploited via the Number (also referred to as Nombre) and Description (also referred to as Descripción) parameters.

Recommendations For Catalyst IT Ltd Mahara CMS version 19.10.2, consider disabling the groupfiles.php component or restricting access to it until a patch is available. Avoid using the Number and Description parameters in the affected component to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-23052

Affected Products

Mahara Cms

References · 4

• 🔥 https://vulnerability-lab.com/get_content.php?id=2217 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-23052 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23052 · Vendor Advisory
• https://t.me/cvenotify/22537 · Telegram Post