Mahara Cross-Site Scripting Vulnerability in Footer Links

A cross-site scripting (XSS) vulnerability has been identified in Mahara versions 24.04 prior to 24.04.2 and 23.04 prior to 23.04.7. The issue arises because the About, Contact, and Help footer links can be customized by administrators without proper sanitization, allowing malicious scripts to be injected. While only admins can set up these links, any logged-in user can click on them, potentially executing the embedded JavaScript.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an injected script is executed in the context of the user's browser.

Remediation

Users are advised to update Mahara to version 24.04.2, 23.04.7, or the latest maintenance release of their current series. Mahara releases can be downloaded from the Mahara website or via a subscription.