CVE-2013-4432
First published: Mon May 19 2014(Updated: )
Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authenticated users to read arbitrary folders (1) by leveraging an active folder tab loaded before permissions were removed or (2) via the folder parameter to artefact/file/groupfiles.php.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mahara | <=1.5.12 | |
| Mahara | =1.5-rc1 | |
| Mahara | =1.5-rc2 | |
| Mahara | =1.5.0 | |
| Mahara | =1.5.1 | |
| Mahara | =1.5.2 | |
| Mahara | =1.5.3 | |
| Mahara | =1.5.4 | |
| Mahara | =1.5.6 | |
| Mahara | =1.5.7 | |
| Mahara | =1.5.8 | |
| Mahara | =1.5.9 | |
| Mahara | =1.5.10 | |
| Mahara | =1.5.11 | |
| Mahara | =1.6.0 | |
| Mahara | =1.6.1 | |
| Mahara | =1.6.2 | |
| Mahara | =1.6.3 | |
| Mahara | =1.6.4 | |
| Mahara | =1.6.5 | |
| Mahara | =1.6.6 | |
| Mahara | =1.6.7 | |
| Mahara | =1.7.-rc1 | |
| Mahara | =1.7.0 | |
| Mahara | =1.7.1 | |
| Mahara | =1.7.2 | |
| Mahara | =1.7.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-4432?
CVE-2013-4432 has been classified with a medium severity level due to improper access restrictions in directory management.
How do I fix CVE-2013-4432?
To fix CVE-2013-4432, upgrade Mahara to version 1.5.13, 1.6.8, or 1.7.4 or later.
What types of systems are affected by CVE-2013-4432?
CVE-2013-4432 affects Mahara versions prior to 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4.
What can a remote authenticated user do with CVE-2013-4432?
A remote authenticated user can leverage this vulnerability to read arbitrary folders that they should not have access to.
Is it safe to use affected versions of Mahara after CVE-2013-4432?
Using affected versions of Mahara is not safe as it may allow unauthorized access to restricted folders.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mahara
- canonical/mahara
- version/mahara/1.5.12
- version/mahara/1.5-rc1
- version/mahara/1.5-rc2
- version/mahara/1.5.0
- version/mahara/1.5.1
- version/mahara/1.5.2
- version/mahara/1.5.3
- version/mahara/1.5.4
- version/mahara/1.5.6
- version/mahara/1.5.7
- version/mahara/1.5.8
- version/mahara/1.5.9
- version/mahara/1.5.10
- version/mahara/1.5.11
- version/mahara/1.6.0
- version/mahara/1.6.1
- version/mahara/1.6.2
- version/mahara/1.6.3
- version/mahara/1.6.4
- version/mahara/1.6.5
- version/mahara/1.6.6
- version/mahara/1.6.7
- version/mahara/1.7.-rc1
- version/mahara/1.7.0
- version/mahara/1.7.1
- version/mahara/1.7.2
- version/mahara/1.7.3