GCVE - cpe:2.3:a:mahara:mahara:1.4:rc1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mahara:mahara:1.4:rc1:*:*:*:*:*:*

part: a version: 1.4 update: rc1

Vendor	Mahara (`07d8f057-c7ff-5103-941c-641bef17cee0`)
Product	Mahara (`e34a4551-28da-5ed2-b032-aa35dad26cc2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/maharaproject/mahara`	purl2cpe	2026-06-01 10:17:27.260526
`pkg:mahara/mahara/mahara`	purl2cpe	2026-06-01 10:17:27.260528

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2012-6037`	vulnerable	2026-06-08 05:02:59.005389	Details available Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the (1) bulk user, (2) group, and (3) group member upload capabilities. NOTE: this issue was originally part of CVE-2012-2243, but that ID was SPLIT due to different issues by different researchers. Published: 2012-11-24T20:00:00.000Z Updated: 2024-08-06T21:21:28.357Z Open on db.gcve.eu Reference links https://mahara.org/interaction/forum/topic.php?id=4937 http://www.debian.org/security/2012/dsa-2591 https://bugs.launchpad.net/mahara/+bug/1063480	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2351`	vulnerable	2026-06-08 05:02:03.809179	Details available The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username. Published: 2012-07-12T20:00:00.000Z Updated: 2024-09-16T17:22:53.601Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/932909 http://gitorious.org/mahara/mahara/commit/f07be6020e70fa8f53cd77fdcd63e7fd7ff8aaea http://www.debian.org/security/2012/dsa-2467 http://www.openwall.com/lists/oss-security/2012/05/11/9 http://www.openwall.com/lists/oss-security/2012/05/12/4	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2247`	vulnerable	2026-06-08 05:02:02.974281	Details available Cross-site scripting (XSS) vulnerability in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to artefact/file/ and a crafted SVG file. Published: 2012-11-24T20:00:00.000Z Updated: 2024-08-06T19:26:08.998Z Open on db.gcve.eu Reference links http://www.debian.org/security/2012/dsa-2591 https://mahara.org/interaction/forum/topic.php?id=4938 https://bugs.launchpad.net/mahara/+bug/1061980	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2246`	vulnerable	2026-06-08 05:02:02.973495	Details available Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php. Published: 2012-11-24T20:00:00.000Z Updated: 2024-08-06T19:26:08.982Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/1057240 http://www.debian.org/security/2012/dsa-2591 https://exchange.xforce.ibmcloud.com/vulnerabilities/79273 https://mahara.org/interaction/forum/topic.php?id=4939	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2244`	vulnerable	2026-06-08 05:02:02.964080	Details available Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote authenticated administrators to execute arbitrary programs by modifying the path to clamav. NOTE: this can be exploited without authentication by leveraging CVE-2012-2243. Published: 2012-11-24T20:00:00.000Z Updated: 2024-08-06T19:26:09.396Z Open on db.gcve.eu Reference links http://www.debian.org/security/2012/dsa-2591 https://bugs.launchpad.net/mahara/+bug/1057238 https://mahara.org/interaction/forum/topic.php?id=4936	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2243`	vulnerable	2026-06-08 05:02:02.955505	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4118`	vulnerable	2026-06-08 04:59:29.554489	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2774`	vulnerable	2026-06-08 04:58:09.218763	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2773`	vulnerable	2026-06-08 04:58:09.218120	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2772`	vulnerable	2026-06-08 04:58:09.216300	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-2771`	vulnerable	2026-06-08 04:58:09.213028	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.