Lucene search

[email protected]CVE-2010-1670

HistoryOct 03, 2022 - 4:21 p.m.

CVE-2010-1670

2022-10-0316:21:01

CWE-287

[email protected]

web.nvd.nist.gov

mahara

authentication bypass

sso

cve-2010-1670

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7 High

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

79.8%

JSON

Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 has improper configuration options for authentication plugins associated with logins that use the single sign-on (SSO) functionality, which allows remote attackers to bypass authentication via an empty password. NOTE: some of these details are obtained from third party information.

Affected configurations

NVD

Node

maharamaharaRange≤1.0.14

maharamaharaMatch0.9.0

maharamaharaMatch0.9.1

maharamaharaMatch0.9.2

maharamaharaMatch1.0.0

maharamaharaMatch1.0.1

maharamaharaMatch1.0.2

maharamaharaMatch1.0.3

maharamaharaMatch1.0.4

maharamaharaMatch1.0.5

maharamaharaMatch1.0.6

maharamaharaMatch1.0.7

maharamaharaMatch1.0.8

maharamaharaMatch1.0.9

maharamaharaMatch1.0.10

maharamaharaMatch1.0.11

maharamaharaMatch1.0.12

maharamaharaMatch1.0.13

Node

maharamaharaMatch1.1.0

maharamaharaMatch1.1.0alpha1

maharamaharaMatch1.1.0alpha2

maharamaharaMatch1.1.0alpha3

maharamaharaMatch1.1.0beta1

maharamaharaMatch1.1.0beta2

maharamaharaMatch1.1.0beta3

maharamaharaMatch1.1.0beta4

maharamaharaMatch1.1.0rc1

maharamaharaMatch1.1.0rc2

maharamaharaMatch1.1.1

maharamaharaMatch1.1.2

maharamaharaMatch1.1.3

maharamaharaMatch1.1.4

maharamaharaMatch1.1.5

maharamaharaMatch1.1.6

maharamaharaMatch1.1.7

maharamaharaMatch1.1.8

Node

maharamaharaMatch1.2.0

maharamaharaMatch1.2.0alpha1

maharamaharaMatch1.2.0alpha2

maharamaharaMatch1.2.0alpha3

maharamaharaMatch1.2.0beta1

maharamaharaMatch1.2.0beta2

maharamaharaMatch1.2.0beta3

maharamaharaMatch1.2.0beta4

maharamaharaMatch1.2.0rc1

maharamaharaMatch1.2.1

maharamaharaMatch1.2.2

maharamaharaMatch1.2.3

maharamaharaMatch1.2.4

CPENameOperatorVersion
mahara:maharamaharale1.0.14
mahara:maharamaharaeq0.9.0
mahara:maharamaharaeq0.9.1
mahara:maharamaharaeq0.9.2
mahara:maharamaharaeq1.0.0
mahara:maharamaharaeq1.0.1
mahara:maharamaharaeq1.0.2
mahara:maharamaharaeq1.0.3
mahara:maharamaharaeq1.0.4
mahara:maharamaharaeq1.0.5

CPE	Name	Operator	Version
mahara:mahara	mahara	le	1.0.14
mahara:mahara	mahara	eq	0.9.0
mahara:mahara	mahara	eq	0.9.1
mahara:mahara	mahara	eq	0.9.2
mahara:mahara	mahara	eq	1.0.0
mahara:mahara	mahara	eq	1.0.1
mahara:mahara	mahara	eq	1.0.2
mahara:mahara	mahara	eq	1.0.3
mahara:mahara	mahara	eq	1.0.4
mahara:mahara	mahara	eq	1.0.5