CVE-2013-4431
First published: Mon May 19 2014(Updated: )
Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allows remote authenticated users to modify arbitrary blocks via the bock id in an edit request.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mahara | <=1.5.11 | |
| Mahara | =1.5-rc1 | |
| Mahara | =1.5-rc2 | |
| Mahara | =1.5.0 | |
| Mahara | =1.5.1 | |
| Mahara | =1.5.2 | |
| Mahara | =1.5.3 | |
| Mahara | =1.5.4 | |
| Mahara | =1.5.6 | |
| Mahara | =1.5.7 | |
| Mahara | =1.5.8 | |
| Mahara | =1.5.9 | |
| Mahara | =1.5.10 | |
| Mahara | =1.7.-rc1 | |
| Mahara | =1.7.0 | |
| Mahara | =1.7.1 | |
| Mahara | =1.7.2 | |
| Mahara | =1.6.0 | |
| Mahara | =1.6.1 | |
| Mahara | =1.6.2 | |
| Mahara | =1.6.3 | |
| Mahara | =1.6.4 | |
| Mahara | =1.6.5 | |
| Mahara | =1.6.6 | |
| <=1.5.11 | ||
| =1.5-rc1 | ||
| =1.5-rc2 | ||
| =1.5.0 | ||
| =1.5.1 | ||
| =1.5.2 | ||
| =1.5.3 | ||
| =1.5.4 | ||
| =1.5.6 | ||
| =1.5.7 | ||
| =1.5.8 | ||
| =1.5.9 | ||
| =1.5.10 | ||
| =1.7.-rc1 | ||
| =1.7.0 | ||
| =1.7.1 | ||
| =1.7.2 | ||
| =1.6.0 | ||
| =1.6.1 | ||
| =1.6.2 | ||
| =1.6.3 | ||
| =1.6.4 | ||
| =1.6.5 | ||
| =1.6.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-4431?
CVE-2013-4431 has a medium severity rating, indicating a potential impact on system integrity.
How do I fix CVE-2013-4431?
To fix CVE-2013-4431, upgrade Mahara to version 1.5.12, 1.6.7, or 1.7.3 or later.
Who is affected by CVE-2013-4431?
CVE-2013-4431 affects users of Mahara versions prior to 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3.
What types of access does CVE-2013-4431 compromise?
CVE-2013-4431 allows remote authenticated users to modify arbitrary blocks by manipulating the block ID.
When was CVE-2013-4431 disclosed?
CVE-2013-4431 was disclosed on October 8, 2013.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/author
- agent/severity
- agent/first-publish-date
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/mahara
- canonical/mahara
- version/mahara/1.5.11
- version/mahara/1.5-rc1
- version/mahara/1.5-rc2
- version/mahara/1.5.0
- version/mahara/1.5.1
- version/mahara/1.5.2
- version/mahara/1.5.3
- version/mahara/1.5.4
- version/mahara/1.5.6
- version/mahara/1.5.7
- version/mahara/1.5.8
- version/mahara/1.5.9
- version/mahara/1.5.10
- version/mahara/1.7.-rc1
- version/mahara/1.7.0
- version/mahara/1.7.1
- version/mahara/1.7.2
- version/mahara/1.6.0
- version/mahara/1.6.1
- version/mahara/1.6.2
- version/mahara/1.6.3
- version/mahara/1.6.4
- version/mahara/1.6.5
- version/mahara/1.6.6