Mahara Cross-Site Scripting Vulnerability in Search Feature

A cross-site scripting (XSS) vulnerability has been identified in Mahara versions prior to 25.04.2 and 24.04.11. This issue arises in the 'search site' feature when the Elasticsearch7 search plugin is active. The vulnerability allows for the execution of malicious code by injecting harmful search query strings, which the Elasticsearch function fails to properly sanitize.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to update to Mahara version 25.04.2 or 24.04.11. Instructions for updating Mahara are available in the Mahara manual.