CVE-2019-9709

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-07 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting (XSS) due to not escaping it when viewing the collection's SmartEvidence overview page (if that feature is turned on). This can be exploited by any logged-in user.

Affected products

mahara: from 17.10.0 before 17.10.8; from 18.04.0 before 18.04.4; from 18.10.0 before 18.10.1 — fixed in 17.10.8, 18.04.4, 18.10.1

How to fix

Upgrade to a fixed version: mahara 17.10.8, 18.04.4, 18.10.1. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/bugs/1819547
https://mahara.org/interaction/forum/topic.php?id=8446
https://bugs.launchpad.net/bugs/1819547
https://mahara.org/interaction/forum/topic.php?id=8446

Get alerted when CVE-2019-9709 or the next vulnerability affects your stack