Design/Logic Flaw

The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the messages of a different user via a modified replyto parameter...

Design/Logic Flaw

The getdatarootimagepath function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service memory consumption via a 1 large or 2 invalid image...

CVE-2011-2772

The getdatarootimagepath function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service memory consumption via a 1 large or 2 invalid image...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution...

CVE-2011-2773

Cross-site request forgery CSRF vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution...

CVE-2011-4118

Mahara before 1.4.1, when MNet aka the Moodle network feature is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target...

CVE-2011-2771

Multiple cross-site scripting XSS vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 URI attributes and 2 the External Feed component, as demonstrated by the guid element in an RSS feed...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 URI attributes and 2 the External Feed component, as demonstrated by the guid element in an RSS feed...

CVE-2011-2773

The CVE-2011-2773 entry concerns Mahara prior to 1.4.1, where a Cross-site request forgery (CSRF) vulnerability could allow remote attackers to hijack administrator authentication for actions that add a user to an institution. Public advisories (Red Hat, Debian DSA-2334-1, OpenVAS) confirm Mahara...

CVE-2011-2772

The CVE-2011-2772 issue affects Mahara up to version 1.4.1, where get_dataroot_image_path in lib/file.php fails to properly validate uploaded images, allowing remote attackers to trigger a denial of service through large or invalid images. Public sources (NVD, Red Hat, Debian) confirm the vulnera...

CVE-2011-2774

The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the messages of a different user via a modified replyto parameter...

CVE-2011-2773

Cross-site request forgery CSRF vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution...

CVE-2011-4118

CVE-2011-4118 affects Mahara before 1.4.1 when using MNet (the Moodle network feature). An authenticated remote user can escalate privileges by jumping to an XMLRPC target, enabling partial confidentiality/integrity/availability impact per the CVSS vector. The public materials indicate the fix is...

CVE-2011-2772

The getdatarootimagepath function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service memory consumption via a 1 large or 2 invalid image...

CVE-2011-2774

The vulnerability CVE-2011-2774 affects Mahara 1.3.x and 1.4.x before 1.4.1, where the "Reply to message" feature allows remote authenticated users to read another user’s messages by tampering with the replyto parameter. Impact is unauthorized access to message content (no additional impact detai...

CVE-2011-4118

Mahara before 1.4.1, when MNet aka the Moodle network feature is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target...

CVE-2011-2771

Mahara (before 1.4.1) is affected by multiple XSS vulnerabilities (CVE-2011-2771) that allow remote attackers to inject arbitrary script/HTML via (1) URI attributes and (2) the External Feed component, demonstrated by the guid element in an RSS feed. Impact is client-side script execution, with n...

CVE-2011-2771

Multiple cross-site scripting XSS vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 URI attributes and 2 the External Feed component, as demonstrated by the guid element in an RSS feed...

Debian DSA-2334-1 : mahara - several vulnerabilities

Several vulnerabilities were discovered in Mahara, an electronic portfolio, weblog, and resume builder : - CVE-2011-2771 Teemu Vesala discovered that missing input sanitising of RSS feeds could lead to cross-site scripting. - CVE-2011-2772 Richard Mansfield discovered that insufficient upload...

[SECURITY] [DSA 2334-1] mahara security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2334-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 04, 2011 http://www.debian.org/security/faq -...