VYPR
← All advisories
Unrated severityNVD Advisory· Published Jul 6, 2010· Updated Apr 29, 2026

CVE-2010-1667

CVE-2010-1667

Description

Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 contains multiple XSS vulnerabilities allowing arbitrary script injection via unspecified vectors.

Vulnerability

Mahara versions prior to 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 are affected by multiple cross-site scripting (XSS) vulnerabilities. The issue is present in unspecified input handling components that fail to properly sanitize user-supplied input before reflection or storage [1][2][3].

Exploitation

An attacker can exploit these vulnerabilities by crafting a malicious URL or payload containing embedded script code. No authentication is required if the vulnerable input is publicly accessible; otherwise, user interaction (e.g., clicking a crafted link) is needed. The precise attack vectors are not detailed in the available references, but they involve injecting arbitrary HTML or JavaScript into the Mahara web application [1][2][3].

Impact

Successful exploitation enables an attacker to execute arbitrary web script or HTML in the context of a victim's browser session. This can lead to session hijacking, credential theft, phishing, or defacement of the affected Mahara site. The attacker gains the ability to perform actions on behalf of the victim within the application [1][2][3].

Mitigation

The Mahara project released fixed versions: 1.0.15, 1.1.9, and 1.2.5. Users should upgrade to one of these versions or later. No workarounds are documented in the provided references, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog [1][2][3].

References
  1. Sign in · GitLab
  2. Sign in · GitLab
  3. Sign in · GitLab

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

49
  • Mahara (software)/Mahara49 versions
    cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*+ 48 more
    • cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*range: <=1.0.14
    • cpe:2.3:a:mahara:mahara:0.9.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:0.9.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:0.9.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.10:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.11:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.12:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.13:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.0.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.0:rc2:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.5:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.1.8:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:beta4:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:mahara:mahara:1.2.4:*:*:*:*:*:*:*
    • (no CPE)range: <1.0.15, <1.1.9, <1.2.5

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.