CVE-2013-4429
First published: Mon May 19 2014(Updated: )
Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict access to artefacts, which allows remote authenticated users to read arbitrary artefacts via the (1) artefact id in an upload action when creating a journal or (2) instconf_artefactid_selected[ID] parameter in an upload action when editing a block.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mahara | <=1.5.11 | |
| Mahara | =1.5-rc1 | |
| Mahara | =1.5-rc2 | |
| Mahara | =1.5.0 | |
| Mahara | =1.5.1 | |
| Mahara | =1.5.2 | |
| Mahara | =1.5.3 | |
| Mahara | =1.5.4 | |
| Mahara | =1.5.6 | |
| Mahara | =1.5.7 | |
| Mahara | =1.5.8 | |
| Mahara | =1.5.9 | |
| Mahara | =1.5.10 | |
| Mahara | =1.7.-rc1 | |
| Mahara | =1.7.0 | |
| Mahara | =1.7.1 | |
| Mahara | =1.7.2 | |
| Mahara | =1.6.0 | |
| Mahara | =1.6.1 | |
| Mahara | =1.6.2 | |
| Mahara | =1.6.3 | |
| Mahara | =1.6.4 | |
| Mahara | =1.6.5 | |
| Mahara | =1.6.6 | |
| <=1.5.11 | ||
| =1.5-rc1 | ||
| =1.5-rc2 | ||
| =1.5.0 | ||
| =1.5.1 | ||
| =1.5.2 | ||
| =1.5.3 | ||
| =1.5.4 | ||
| =1.5.6 | ||
| =1.5.7 | ||
| =1.5.8 | ||
| =1.5.9 | ||
| =1.5.10 | ||
| =1.7.-rc1 | ||
| =1.7.0 | ||
| =1.7.1 | ||
| =1.7.2 | ||
| =1.6.0 | ||
| =1.6.1 | ||
| =1.6.2 | ||
| =1.6.3 | ||
| =1.6.4 | ||
| =1.6.5 | ||
| =1.6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-4429?
The severity of CVE-2013-4429 has been classified as medium due to its potential impact on unauthorized access to artefacts.
How do I fix CVE-2013-4429?
To fix CVE-2013-4429, upgrade to Mahara version 1.5.12, 1.6.7, or 1.7.3 or later.
What versions are affected by CVE-2013-4429?
CVE-2013-4429 affects Mahara versions prior to 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3.
What types of access does CVE-2013-4429 allow?
CVE-2013-4429 allows remote authenticated users to read arbitrary artefacts due to insufficient restrictions.
What is the nature of the vulnerability in CVE-2013-4429?
The vulnerability in CVE-2013-4429 is related to improper access control, allowing exposure of sensitive artefacts.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/first-publish-date
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/mahara
- canonical/mahara
- version/mahara/1.5.11
- version/mahara/1.5-rc1
- version/mahara/1.5-rc2
- version/mahara/1.5.0
- version/mahara/1.5.1
- version/mahara/1.5.2
- version/mahara/1.5.3
- version/mahara/1.5.4
- version/mahara/1.5.6
- version/mahara/1.5.7
- version/mahara/1.5.8
- version/mahara/1.5.9
- version/mahara/1.5.10
- version/mahara/1.7.-rc1
- version/mahara/1.7.0
- version/mahara/1.7.1
- version/mahara/1.7.2
- version/mahara/1.6.0
- version/mahara/1.6.1
- version/mahara/1.6.2
- version/mahara/1.6.3
- version/mahara/1.6.4
- version/mahara/1.6.5
- version/mahara/1.6.6