{"id":"CVE-2012-2239","aliases":["DSA-2591-1","EUVD-2012-2232","GHSA-86gr-hf8c-38jv"],"status":"published","title":"Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files...","description":"Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01551,"percentile":0.75265,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-611","CWE-94"],"published":"2012-11-24T20:00:00Z","modified":"2026-06-16T23:41:13Z","affected":[{"source":"osv","ecosystem":"Debian:6.0","package":"mahara","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.6-2+squeeze6"}]}],"versions":["1.2.6-2","1.2.6-2+squeeze1","1.2.6-2+squeeze2","1.2.6-2+squeeze3","1.2.6-2+squeeze4","1.2.6-2+squeeze5"],"bundled":7}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mahara","product":"mahara"}],"references":[{"url":"http://www.debian.org/security/2012/dsa-2591","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List"]},{"url":"https://bugs.launchpad.net/mahara/+bug/1047111","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch"]},{"url":"https://mahara.org/interaction/forum/topic.php?id=4869","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-2239"},{"url":"https://github.com/advisories/GHSA-86gr-hf8c-38jv"}],"sources":{"cve":[{"id":"CVE-2012-2239","description":"Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.","status":"published","published":"2012-11-24T20:00:00Z","modified":"2024-08-06T19:26:08.975Z","updated_at":"2026-11-02T14:34:50.263482Z"}],"euvd":[{"id":"EUVD-2012-2232","description":"Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.","status":"published","published":"2012-11-24T20:00:00Z","modified":"2024-08-06T19:26:08Z","updated_at":"2026-11-03T01:56:14.86717Z"}],"ghsa":[{"id":"GHSA-86gr-hf8c-38jv","title":"Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files...","description":"Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.","status":"published","published":"2022-05-17T05:15:19Z","modified":"2026-03-21T05:37:41Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-94","CWE-611"],"updated_at":"2026-11-02T15:06:45.356317Z"}],"nvd":[{"id":"CVE-2012-2239","description":"Mahara 1.4.x before 1.4.4 and 1.5.x before 1.5.3 allows remote attackers to read arbitrary files or create TCP connections via an XML external entity (XXE) injection attack, as demonstrated by reading config.php.","status":"published","published":"2012-11-24T20:55:02.087Z","modified":"2026-06-16T23:41:13.54Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:02:16.536025Z"}],"osv":[{"id":"DSA-2591-1","title":"mahara - several","status":"published","published":"2012-12-27T00:00:00Z","modified":"2026-03-09T01:23:36.424063Z","updated_at":"2026-11-02T15:46:15.489951Z"}]}}