CVE-2017-1000171

CVE-2017-1000171 affects Mahara Mobile prior to version 1.2.1, where passwords are logged in plaintext to the Mahara access log. The issue stems from logging sensitive credentials, enabling potential exposure of passwords via log access. Impact is information disclosure of login credentials via l...

CVE-2017-1000140

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to a maliciously created .xml file that can have its code executed when user tries to download the file...

CVE-2017-1000145

Mahara up to 1.9.7, 1.10 up to 1.10.5, and 15.04 up to 15.04.2 are vulnerable to anonymous comments on artefact detail pages even when anonymous comments are disallowed. The issue affects the artefact detail page comment handling and is described consistently across multiple sources (CVE-2017-100...

CVE-2017-1000134

Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group files they uploaded if another group member changes the access permissions on them...

CVE-2017-1000133

Mahara versions affected: 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2. The vulnerability allows an attacker to cause another user’s artefacts to be included in the attacker’s Leap2a export, effectively enabling exposure of another user’s artefacts. Some connected sources ...

CVE-2017-1000139

Mahara versions 1.8 before 1.8.7, 1.9 before 1.9.5, 1.10 before 1.10.3, and 15.04 before 15.04.0 are vulnerable to server-side request forgery (SSRF) because curl redirects are not consistently checked against a white/black list. Employing SafeCurl will prevent issues.

CVE-2017-1000138

The provided documents confirm CVE-2017-1000138 affects Mahara 1.10 before 1.10.0 and 15.04 before 15.04.0. The issue is a cross-site scripting vulnerability triggered when a user drags/drops a file into a collection whose title contains JavaScript code, allowing injected script if the title is c...

CVE-2017-1000155

Summary: Mahara 15.04 (before 15.04.8), 15.10 (before 15.10.4), and 16.04 (before 16.04.2) are vulnerable due to a failure in access control detection, enabling disclosure of any user-uploaded profile pictures whether or not they are in use. Details evidenced in connected docs: The vulnerability ...

CVE-2017-1000144

Mahara up to versions 1.9.6, 1.10.4, and 15.04.1 are affected by a stored cross-site scripting vulnerability. An admin can place HTML/JavaScript into an institution display name, which is then rendered unescaped to other users on some Mahara pages. Root cause: unescaped user-generated content in ...

CVE-2017-1000131

Mahara is affected by CVE-2017-1000131: versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 allow a user to remain logged in after logout when using MNet SSO with Moodle. The root cause is Mahara not properly implementing one of the MNet SSO API functions. Public details...

CVE-2017-1000147

CVE-2017-1000147 affects Mahara 1.9 before 1.9.8, 1.10 before 1.10.6, and 15.04 before 15.04.3. It enables a CSRF on the uploader in Mahara’s filebrowser widget, allowing an attacker to trick a user into uploading malicious files to their Mahara account. The provided documents do not specify a pa...

CVE-2017-1000156

Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role...

CVE-2017-1000150

Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks...

CVE-2017-1000151

Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to passwords or other sensitive information being passed by unusual parameters to end up in an error log...

CVE-2017-1000142

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to users being able to delete their submitted page through URL manipulation...

CVE-2017-1000139

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable to server-side request forgery attacks as not all processes of curl redirects are checked against a white or black list. Employing SafeCurl will prevent issues...

CVE-2017-1000144

Mahara 1.9 before 1.9.6 and 1.10 before 1.10.4 and 15.04 before 15.04.1 are vulnerable to a site admin or institution admin being able to place HTML and Javascript into an institution display name, which will be displayed to other users unescaped on some Mahara system pages...

CVE-2017-1000135

CVE-2017-1000135 affects Mahara 1.8 before 1.8.7, 1.9 before 1.9.5, 1.10 before 1.10.3, and 15.04 before 15.04.0. The vulnerability allows logged-in users to remain authenticated after the institution they belong to is suspended. The connected documents corroborate the affected versions and the l...

CVE-2017-1000135

Mahara 1.8 before 1.8.7 and 1.9 before 1.9.5 and 1.10 before 1.10.3 and 15.04 before 15.04.0 are vulnerable as logged-in users can stay logged in after the institution they belong to is suspended...

CVE-2017-1000137

Mahara is affected: versions 1.10 before 1.10.0 and 15.04 before 15.04.0 are vulnerable to cross-site scripting when a text block is added to a page via the keyboard (not drag-and-drop). Root cause reported as an XSS issue in these build paths. Exploit details, mitigations, and fixes are not prov...