PT-2022-6323 · Canonical · Ubuntu

Fergus Whyte · Published 2022-06-22 · Updated 2022-11-10 · CVE-2022-44544

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mahara versions 21.04 through 21.04.6 Mahara versions 21.10 through 21.10.4 Mahara versions 22.04 through 22.04.2 Mahara version 22.10.0

Description The vulnerability exists due to the lack of protection of the web page structure in the PDF Export function of the Mahara open-source e-portfolio web system. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability can potentially allow a PDF export to trigger a remote shell if the site is running on Ubuntu and the flag -dSAFER is not set with Ghostscript.

Recommendations For Mahara versions 21.04 through 21.04.6, update to version 21.04.7 or later. For Mahara versions 21.10 through 21.10.4, update to version 21.10.5 or later. For Mahara versions 22.04 through 22.04.2, update to version 22.04.3 or later. For Mahara version 22.10.0, update to a version later than 22.10.0. As a temporary workaround, consider setting the flag -dSAFER with Ghostscript to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

CWE-250

Related Identifiers

BDU:2023-00901

CVE-2022-44544

Affected Products

Ubuntu

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-44544 · Security Note
• https://bdu.fstec.ru/vul/2023-00901 · Security Note
• https://mahara.org/interaction/forum/topic.php?id=9198 · Vendor Advisory
• https://bugs.launchpad.net/mahara/+bug/1979575 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-44544 · Vendor Advisory
• https://bugs.launchpad.net/mahara/22.10/+bug/1979575 · Note
• https://t.me/cvenotify/37476 · Telegram Post