GCVE - cpe:2.3:a:mahara:mahara:1.3.0:rc1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mahara:mahara:1.3.0:rc1:*:*:*:*:*:*

part: a version: 1.3.0 update: rc1

Vendor	Mahara (`07d8f057-c7ff-5103-941c-641bef17cee0`)
Product	Mahara (`e34a4551-28da-5ed2-b032-aa35dad26cc2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/maharaproject/mahara`	purl2cpe	2026-06-01 10:17:27.260479
`pkg:mahara/mahara/mahara`	purl2cpe	2026-06-01 10:17:27.260480

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-2351`	vulnerable	2026-06-08 05:02:03.804448	Details available The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username. Published: 2012-07-12T20:00:00.000Z Updated: 2024-09-16T17:22:53.601Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/932909 http://gitorious.org/mahara/mahara/commit/f07be6020e70fa8f53cd77fdcd63e7fd7ff8aaea http://www.debian.org/security/2012/dsa-2467 http://www.openwall.com/lists/oss-security/2012/05/11/9 http://www.openwall.com/lists/oss-security/2012/05/12/4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4118`	vulnerable	2026-06-08 04:59:29.548518	Details available Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-17T02:47:30.591Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://launchpad.net/mahara/+milestone/1.4.1 http://mahara.org/interaction/forum/topic.php?id=4138 http://openwall.com/lists/oss-security/2011/11/04/10 http://www.debian.org/security/2011/dsa-2334	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2774`	vulnerable	2026-06-08 04:58:09.218640	Details available The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the messages of a different user via a modified replyto parameter. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-16T17:54:13.701Z Open on db.gcve.eu Reference links https://launchpad.net/mahara/+milestone/1.4.1 https://launchpad.net/bugs/798128 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2773`	vulnerable	2026-06-08 04:58:09.217996	Details available Cross-site request forgery (CSRF) vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-16T18:48:36.304Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://bugs.launchpad.net/mahara/+bug/800032 https://launchpad.net/mahara/+milestone/1.4.1 http://www.debian.org/security/2011/dsa-2334 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2772`	vulnerable	2026-06-08 04:58:09.216175	Details available The get_dataroot_image_path function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service (memory consumption) via a (1) large or (2) invalid image. Published: 2011-11-15T02:00:00.000Z Updated: 2024-09-17T03:18:11.960Z Open on db.gcve.eu Reference links http://security.debian.org/debian-security/pool/updates/main/m/mahara/mahara_1.2.6-2+squeeze3.debian.tar.gz https://launchpad.net/mahara/+milestone/1.4.1 https://bugs.launchpad.net/mahara/+bug/784978 http://www.debian.org/security/2011/dsa-2334 http://secunia.com/advisories/46719	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2771`	vulnerable	2026-06-08 04:58:09.204518	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1406`	vulnerable	2026-06-08 04:57:59.029644	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1405`	vulnerable	2026-06-08 04:57:59.027635	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1404`	vulnerable	2026-06-08 04:57:59.025499	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1403`	vulnerable	2026-06-08 04:57:59.023459	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-1402`	vulnerable	2026-06-08 04:57:59.019144	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0440`	vulnerable	2026-06-08 04:56:37.133876	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-0439`	vulnerable	2026-06-08 04:56:37.131782	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-3871`	vulnerable	2026-06-08 04:55:17.702637	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.