GCVE - cpe:2.3:a:mahara:mahara:1.3.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mahara:mahara:1.3.0:*:*:*:*:*:*:*

part: a version: 1.3.0 update: *

Vendor	Mahara (`07d8f057-c7ff-5103-941c-641bef17cee0`)
Product	Mahara (`e34a4551-28da-5ed2-b032-aa35dad26cc2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/maharaproject/mahara`	purl2cpe	2026-06-01 10:17:27.260463
`pkg:mahara/mahara/mahara`	purl2cpe	2026-06-01 10:17:27.260464

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-2351`	vulnerable	2026-06-08 05:02:03.801854	Details available The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username. Published: 2012-07-12T20:00:00.000Z Updated: 2024-09-16T17:22:53.601Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/932909 http://gitorious.org/mahara/mahara/commit/f07be6020e70fa8f53cd77fdcd63e7fd7ff8aaea http://www.debian.org/security/2012/dsa-2467 http://www.openwall.com/lists/oss-security/2012/05/11/9 http://www.openwall.com/lists/oss-security/2012/05/12/4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4118`	vulnerable	2026-06-08 04:59:29.545546	Details available Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-17T02:47:30.591Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://launchpad.net/mahara/+milestone/1.4.1 http://mahara.org/interaction/forum/topic.php?id=4138 http://openwall.com/lists/oss-security/2011/11/04/10 http://www.debian.org/security/2011/dsa-2334	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2774`	vulnerable	2026-06-08 04:58:09.218552	Details available The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the messages of a different user via a modified replyto parameter. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-16T17:54:13.701Z Open on db.gcve.eu Reference links https://launchpad.net/mahara/+milestone/1.4.1 https://launchpad.net/bugs/798128 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2773`	vulnerable	2026-06-08 04:58:09.217918	Details available Cross-site request forgery (CSRF) vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-16T18:48:36.304Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://bugs.launchpad.net/mahara/+bug/800032 https://launchpad.net/mahara/+milestone/1.4.1 http://www.debian.org/security/2011/dsa-2334 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2772`	vulnerable	2026-06-08 04:58:09.216090	Details available The get_dataroot_image_path function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service (memory consumption) via a (1) large or (2) invalid image. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-17T03:18:11.960Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://launchpad.net/mahara/+milestone/1.4.1 https://bugs.launchpad.net/mahara/+bug/784978 http://www.debian.org/security/2011/dsa-2334 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2771`	vulnerable	2026-06-08 04:58:09.204438	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1406`	vulnerable	2026-06-08 04:57:59.029559	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1405`	vulnerable	2026-06-08 04:57:59.027466	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1404`	vulnerable	2026-06-08 04:57:59.025419	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1403`	vulnerable	2026-06-08 04:57:59.023378	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1402`	vulnerable	2026-06-08 04:57:59.016459	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0440`	vulnerable	2026-06-08 04:56:37.133795	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0439`	vulnerable	2026-06-08 04:56:37.129111	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-3871`	vulnerable	2026-06-08 04:55:17.699762	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.