CVE-2012-2246: Input Validation
Published Nov 24, 2012
·Updated
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php.
Affected Software
15 affected components
Mahara Mahara=1.4-rc1
Mahara Mahara=1.4-rc2
Mahara Mahara=1.4-rc3
Mahara Mahara=1.4-rc4
Mahara Mahara=1.4.0
Mahara Mahara=1.4.1
Mahara Mahara=1.4.2
Mahara Mahara=1.4.3
Mahara Mahara=1.4.4
Mahara Mahara=1.5-rc1
Mahara Mahara=1.5-rc2
Mahara Mahara=1.5.0
Mahara Mahara=1.5.1
Mahara Mahara=1.5.2
Mahara Mahara=1.5.3
Event History
Nov 24, 2012
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2246?
CVE-2012-2246 has been classified as a moderate severity vulnerability due to its potential for causing unauthorized actions.
2
How do I fix CVE-2012-2246?
To fix CVE-2012-2246, update Mahara to version 1.4.5 or 1.5.4 or newer.
3
Who is affected by CVE-2012-2246?
CVE-2012-2246 affects Mahara versions 1.4.x before 1.4.5 and 1.5.x before 1.5.4.
4
What type of attack does CVE-2012-2246 facilitate?
CVE-2012-2246 facilitates clickjacking attacks that can allow unauthorized user deletion.
5
Is CVE-2012-2246 related to CSRF vulnerabilities?
Yes, CVE-2012-2246 allows attackers to bypass CSRF protection mechanisms.