CVE-2017-17454

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-20 · updated 2026-06-17
Weakness: CWE-79

Description

Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible, and instead use param_exists() and the correct param_*() function to fetch the expected value.

Affected products

mahara: from 16.10.0 before 16.10.7; from 17.04.0 before 17.04.5; from 17.10.0 before 17.10.2 — fixed in 16.10.7, 17.04.5, 17.10.2

How to fix

Upgrade to a fixed version: mahara 16.10.7, 17.04.5, 17.10.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-17454 or the next vulnerability affects your stack