GCVE - cpe:2.3:a:mahara:mahara:1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mahara:mahara:1.1:*:*:*:*:*:*:*

part: a version: 1.1 update: *

Vendor	Mahara (`07d8f057-c7ff-5103-941c-641bef17cee0`)
Product	Mahara (`e34a4551-28da-5ed2-b032-aa35dad26cc2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/maharaproject/mahara`	purl2cpe	2026-06-01 10:17:27.260322
`pkg:mahara/mahara/mahara`	purl2cpe	2026-06-01 10:17:27.260323

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-2351`	vulnerable	2026-06-08 05:02:03.781948	Details available The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username. Published: 2012-07-12T20:00:00.000Z Updated: 2024-09-16T17:22:53.601Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/932909 http://gitorious.org/mahara/mahara/commit/f07be6020e70fa8f53cd77fdcd63e7fd7ff8aaea http://www.debian.org/security/2012/dsa-2467 http://www.openwall.com/lists/oss-security/2012/05/11/9 http://www.openwall.com/lists/oss-security/2012/05/12/4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4118`	vulnerable	2026-06-08 04:59:29.525214	Details available Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-17T02:47:30.591Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://launchpad.net/mahara/+milestone/1.4.1 http://mahara.org/interaction/forum/topic.php?id=4138 http://openwall.com/lists/oss-security/2011/11/04/10 http://www.debian.org/security/2011/dsa-2334	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2773`	vulnerable	2026-06-08 04:58:09.217369	Details available Cross-site request forgery (CSRF) vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-16T18:48:36.304Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://bugs.launchpad.net/mahara/+bug/800032 https://launchpad.net/mahara/+milestone/1.4.1 http://www.debian.org/security/2011/dsa-2334 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2772`	vulnerable	2026-06-08 04:58:09.215522	Details available The get_dataroot_image_path function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service (memory consumption) via a (1) large or (2) invalid image. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-17T03:18:11.960Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://launchpad.net/mahara/+milestone/1.4.1 https://bugs.launchpad.net/mahara/+bug/784978 http://www.debian.org/security/2011/dsa-2334 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2771`	vulnerable	2026-06-08 04:58:09.203847	Details available Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) URI attributes and (2) the External Feed component, as demonstrated by the guid element in an RSS feed. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-17T00:31:22.037Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://launchpad.net/mahara/+milestone/1.4.1 http://www.debian.org/security/2011/dsa-2334 https://bugs.launchpad.net/mahara/+bug/798136 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1406`	vulnerable	2026-06-08 04:57:59.028673	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1405`	vulnerable	2026-06-08 04:57:59.026781	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1404`	vulnerable	2026-06-08 04:57:59.024637	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1403`	vulnerable	2026-06-08 04:57:59.022767	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1402`	vulnerable	2026-06-08 04:57:58.996641	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-3871`	vulnerable	2026-06-08 04:55:17.693245	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2171`	vulnerable	2026-06-08 04:51:27.050315	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-2170`	vulnerable	2026-06-08 04:51:27.042759	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.