Description (CNA)
Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- http://www.debian.org/security/2012/dsa-2591
- https://bugs.launchpad.net/mahara/+bug/1047111
- https://mahara.org/interaction/forum/topic.php?id=4869
ADP enrichment
No English description supplied.