CVE-2018-11565: Infoleak

Q: What is CVE-2018-11565?

CVE-2018-11565 is a vulnerability in Mahara versions 17.04 before 17.04.8, 17.10 before 17.10.5, and 18.04 before 18.04.1 that allows mentioning usernames that are already taken by people registered in the system.

Q: How severe is CVE-2018-11565?

CVE-2018-11565 has a severity rating of medium with a CVSS score of 5.3.

Q: Which versions of Mahara are affected by CVE-2018-11565?

Mahara versions 17.04 before 17.04.8, 17.10 before 17.10.5, and 18.04 before 18.04.1 are affected by CVE-2018-11565.

Q: What is the CWE category of CVE-2018-11565?

CVE-2018-11565 falls under the CWE category 200, which is Information Exposure.

Q: How can I fix CVE-2018-11565?

To fix CVE-2018-11565, it is recommended to upgrade to the latest patched version of Mahara.

Published May 30, 2018

Updated

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information.

Affected Software

3 affected components

Mahara Mahara>=17.04.0<17.04.8

Mahara Mahara>=17.10.0<17.10.5

Mahara Mahara=18.04.0

Remediation

Patch Available

https://bugs.launchpad.net/mahara/+bug/1772774

Event History

May 30, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is CVE-2018-11565?

CVE-2018-11565 is a vulnerability in Mahara versions 17.04 before 17.04.8, 17.10 before 17.10.5, and 18.04 before 18.04.1 that allows mentioning usernames that are already taken by people registered in the system.

How severe is CVE-2018-11565?

CVE-2018-11565 has a severity rating of medium with a CVSS score of 5.3.

Which versions of Mahara are affected by CVE-2018-11565?