CVE-2025-61872

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-61872", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-04-24T15:03:27.399Z", "dateReserved": "2025-10-03T00:00:00.000Z", "datePublished": "2026-04-24T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-24T14:36:36.403Z"}, "descriptions": [{"lang": "en", "value": "Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query parameter."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://mahara.org"}, {"url": "https://mahara.org/interaction/forum/topic.php?id=9851"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T15:02:34.716958Z", "id": "CVE-2025-61872", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T15:03:27.399Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-61872", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-24T15:02:34.716958Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T15:02:03.716Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://mahara.org"}, {"url": "https://mahara.org/interaction/forum/topic.php?id=9851"}], "descriptions": [{"lang": "en", "value": "Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-24T14:36:36.403Z"}}}, "cveMetadata": {"cveId": "CVE-2025-61872", "state": "PUBLISHED", "dateUpdated": "2026-04-24T15:03:27.399Z", "dateReserved": "2025-10-03T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-24T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query parameter."}, {"lang": "es", "value": "Mahara anterior a las versiones 25.04.2 y 24.04.11 son vulnerables a mostrar resultados que pueden desencadenar XSS a trav\u00e9s de una cadena de consulta de b\u00fasqueda maliciosa. Esto ocurre en la funci\u00f3n \u2019buscar sitio\u2019 al usar el plugin de b\u00fasqueda Elasticsearch7. La funci\u00f3n de Elasticsearch no sanitiza correctamente la entrada en el par\u00e1metro de consulta."}], "id": "CVE-2025-61872", "lastModified": "2026-11-04T20:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61872", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T15:02:34.716958Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:25.320", "references": [{"source": "cve@mitre.org", "url": "https://mahara.org"}, {"source": "cve@mitre.org", "url": "https://mahara.org/interaction/forum/topic.php?id=9851"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,25.04.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,24.04.11)"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "mahara", "vendor": "mahara"}], "analysis": {"en": {"generated_at": "2026-04-28T07:11:05.885655+00:00", "value": {"mitigation_remediation": ["Upgrade Mahara to 25.04.2 or later, and to 24.04.11 or later, to eliminate the flaw.", "Disable the Elasticsearch7 search plugin if it cannot be upgraded, or limit its use to trusted users.", "Implement server\u2011side input validation that sanitizes query parameters to prevent reflected XSS."], "summary": {"action": "Upgrade", "impact": "Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The issue is present in Mahara releases before 25.04.2 and before 24.04.11 when the Elasticsearch7 search plugin is enabled. Any system running these versions and exposing the search feature to external users is vulnerable.", "description_and_impact": "Mahara allows a reflected cross\u2011site scripting attack when users submit a malicious query through its \u2018search site\u2019 feature. The Elasticsearch7 plugin used by the platform fails to sanitize the search string, causing user\u2011controlled input to be rendered in the search results. This flaw can be exploited to run arbitrary JavaScript in the context of a victim\u2019s browser.", "risk_and_exploitability": "The CVSS score of 6.1 indicates a moderate severity, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV inventory. Attackers can trigger the flaw remotely by sending a crafted search query from an external source, and the impact depends on the user's session privileges and the web console\u2019s execution context."}}}}, "created": "2026-04-27T19:15:11.633809+00:00", "title": "Mahara XSS Vulnerability via Malicious Search Query in Elasticsearch7 Plugin", "updated": "2026-04-28T07:15:19.378351+00:00", "vendors": ["mahara", "mahara$PRODUCT$mahara"]}