Mahara Cross-Site Scripting Vulnerability in RSS Feed Block

A cross-site scripting (XSS) vulnerability has been identified in Mahara versions 23.04.8 and 24.04.4. The issue arises in the external RSS feed block, where a malicious link attribute in the feed's XML can be exploited to inject harmful scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to Mahara 24.04.6 or 23.04.9, both of which include the necessary fix. Instructions for downloading these versions are available on the Mahara Git repository.