CVE-2018-6182
Last modified
CVE-2018-6182 is a vulnerability of currently unknown severity. Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can create own packets of POST data containing bad content with which to hit the server.. EPSS estimates a 0.70% chance of exploitation in the next 30 days.
Description
Mahara 16.10 before 16.10.9 and 17.04 before 17.04.7 and 17.10 before 17.10.4 are vulnerable to bad input when TinyMCE is bypassed by POST packages. Therefore, Mahara should not rely on TinyMCE's code stripping alone but also clean input on the server / PHP side as one can create own packets of POST data containing bad content with which to hit the server.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mahara | Mahara | >= 16.10, < 16.10.9 |
| Mahara | Mahara | >= 17.04, < 17.04.7 |
| Mahara | Mahara | >= 17.10, < 17.10.4 |
References
- https://bugs.launchpad.net/mahara/+bug/1744789Issue Tracking, Third Party Advisory
- https://mahara.org/interaction/forum/topic.php?id=8215Vendor Advisory
- https://bugs.launchpad.net/mahara/+bug/1744789Issue Tracking, Third Party Advisory
- https://mahara.org/interaction/forum/topic.php?id=8215Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-6182?
How severe is CVE-2018-6182?
How do I fix CVE-2018-6182?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-6175Incorrect handling of confusable characters in URL Formatter…
- CVE-2018-6176Insufficient file type enforcement in Extensions API in Goog…
- CVE-2018-6177Information leak in media engine in Google Chrome prior to 6…
- CVE-2018-6178Eliding from the wrong side in an infobar in DevTools in Goo…
- CVE-2018-6179Insufficient enforcement of file access permission in the ac…
- CVE-2018-6180A flaw in the profile section of Online Voting System 1.0 al…9.8
- CVE-2018-6183BitDefender Total Security 2018 allows local users to gain p…
- CVE-2018-6184ZEIT Next.js 4 before 4.2.3 has Directory Traversal under th…
- CVE-2018-6185In Cloudera Navigator Key Trustee KMS 5.12 and 5.13, incorre…
- CVE-2018-6186Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF …
- CVE-2018-6187In Artifex MuPDF 1.12.0, there is a heap-based buffer overfl…
- CVE-2018-6188django.contrib.auth.forms.AuthenticationForm in Django 2.0 b…
Are you affected by CVE-2018-6182?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST