CVE-2011-0440: CSRF
Published Mar 28, 2011
·Updated
Cross-site request forgery (CSRF) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs.
Affected Software
24 affected components
Mahara Mahara=1.2.0
Mahara Mahara=1.2.0-alpha1
Mahara Mahara=1.2.0-alpha2
Mahara Mahara=1.2.0-alpha3
Mahara Mahara=1.2.0-beta1
Mahara Mahara=1.2.0-beta2
Mahara Mahara=1.2.0-beta3
Mahara Mahara=1.2.0-beta4
Mahara Mahara=1.2.0-rc1
Mahara Mahara=1.2.1
Mahara Mahara=1.2.2
Mahara Mahara=1.2.3
Mahara Mahara=1.2.4
Mahara Mahara=1.2.5
Mahara Mahara=1.2.6
Mahara Mahara=1.3.0
Mahara Mahara=1.3.0-beta1
Mahara Mahara=1.3.0-beta2
Mahara Mahara=1.3.0-beta3
Mahara Mahara=1.3.0-beta4
Mahara Mahara=1.3.0-rc1
Mahara Mahara=1.3.1
Mahara Mahara=1.3.2
Mahara Mahara=1.3.3
Event History
Mar 28, 2011
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-0440?
CVE-2011-0440 is considered a medium severity vulnerability due to its potential to allow unauthorized actions via CSRF.
2
How do I fix CVE-2011-0440?
To fix CVE-2011-0440, upgrade Mahara to version 1.2.7 or 1.3.4 or later.
3
Which versions of Mahara are affected by CVE-2011-0440?
CVE-2011-0440 affects Mahara versions 1.2.x prior to 1.2.7 and 1.3.x prior to 1.3.4.
4
What type of attack does CVE-2011-0440 allow?
CVE-2011-0440 allows attackers to perform cross-site request forgery (CSRF) attacks that can hijack authentication for deleting blogs.
5
Is CVE-2011-0440 still exploitable in the latest versions of Mahara?
No, CVE-2011-0440 is not exploitable in the latest versions of Mahara after implementing the necessary updates.