GCVE - cpe:2.3:a:mahara:mahara:1.5.2:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mahara:mahara:1.5.2:*:*:*:*:*:*:*

part: a version: 1.5.2 update: *

Vendor	Mahara (`07d8f057-c7ff-5103-941c-641bef17cee0`)
Product	Mahara (`e34a4551-28da-5ed2-b032-aa35dad26cc2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/maharaproject/mahara`	purl2cpe	2026-06-01 10:17:27.260639
`pkg:mahara/mahara/mahara`	purl2cpe	2026-06-01 10:17:27.260640

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4432`	vulnerable	2026-06-08 05:04:46.703294	Details available Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authenticated users to read arbitrary folders (1) by leveraging an active folder tab loaded before permissions were removed or (2) via the folder parameter to artefact/file/groupfiles.php. Published: 2014-05-19T14:00:00.000Z Updated: 2024-08-06T16:45:13.524Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2013/10/08/3 https://mahara.org/interaction/forum/topic.php?id=5864 http://www.openwall.com/lists/oss-security/2013/10/15/1 http://www.openwall.com/lists/oss-security/2013/10/16/7 https://bugs.launchpad.net/mahara/+bug/1034180	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4431`	vulnerable	2026-06-08 05:04:46.702280	Details available Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allows remote authenticated users to modify arbitrary blocks via the bock id in an edit request. Published: 2014-05-19T14:00:00.000Z Updated: 2024-08-06T16:45:13.487Z Open on db.gcve.eu Reference links https://mahara.org/interaction/forum/topic.php?id=5753 http://www.openwall.com/lists/oss-security/2013/10/08/3 http://www.openwall.com/lists/oss-security/2013/10/15/1 http://www.openwall.com/lists/oss-security/2013/10/16/7 https://bugs.launchpad.net/mahara/+bug/1233500	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4430`	vulnerable	2026-06-08 05:04:46.697606	Details available Cross-site scripting (XSS) vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inject arbitrary web script or HTML via the Host header to lib/web.php. Published: 2014-05-19T14:00:00.000Z Updated: 2024-08-06T16:45:13.343Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/1175446 http://www.openwall.com/lists/oss-security/2013/10/08/3 https://mahara.org/interaction/forum/topic.php?id=5754 http://www.openwall.com/lists/oss-security/2013/10/15/1 http://www.openwall.com/lists/oss-security/2013/10/16/7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4429`	vulnerable	2026-06-08 05:04:36.178582	Details available Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict access to artefacts, which allows remote authenticated users to read arbitrary artefacts via the (1) artefact id in an upload action when creating a journal or (2) instconf_artefactid_selected[ID] parameter in an upload action when editing a block. Published: 2014-05-19T14:00:00.000Z Updated: 2024-08-06T16:45:13.850Z Open on db.gcve.eu Reference links https://mahara.org/interaction/forum/topic.php?id=5753 http://www.openwall.com/lists/oss-security/2013/10/08/3 http://www.openwall.com/lists/oss-security/2013/10/15/1 https://bugs.launchpad.net/mahara/+bug/1211758 http://www.openwall.com/lists/oss-security/2013/10/16/7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-6037`	vulnerable	2026-06-08 05:02:59.012198	Details available Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the (1) bulk user, (2) group, and (3) group member upload capabilities. NOTE: this issue was originally part of CVE-2012-2243, but that ID was SPLIT due to different issues by different researchers. Published: 2012-11-24T20:00:00.000Z Updated: 2024-08-06T21:21:28.357Z Open on db.gcve.eu Reference links https://mahara.org/interaction/forum/topic.php?id=4937 http://www.debian.org/security/2012/dsa-2591 https://bugs.launchpad.net/mahara/+bug/1063480	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2253`	vulnerable	2026-06-08 05:02:03.061210	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2247`	vulnerable	2026-06-08 05:02:02.974502	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2246`	vulnerable	2026-06-08 05:02:02.973742	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2244`	vulnerable	2026-06-08 05:02:02.964306	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2243`	vulnerable	2026-06-08 05:02:02.962888	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.