GCVE - cpe:2.3:a:mahara:mahara:1.6.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mahara:mahara:1.6.4:*:*:*:*:*:*:*

part: a version: 1.6.4 update: *

Vendor	Mahara (`07d8f057-c7ff-5103-941c-641bef17cee0`)
Product	Mahara (`e34a4551-28da-5ed2-b032-aa35dad26cc2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/maharaproject/mahara`	purl2cpe	2026-06-01 10:17:27.260754
`pkg:mahara/mahara/mahara`	purl2cpe	2026-06-01 10:17:27.260756

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4432`	vulnerable	2026-06-08 05:04:46.707446	Details available Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authenticated users to read arbitrary folders (1) by leveraging an active folder tab loaded before permissions were removed or (2) via the folder parameter to artefact/file/groupfiles.php. Published: 2014-05-19T14:00:00.000Z Updated: 2024-08-06T16:45:13.524Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2013/10/08/3 https://mahara.org/interaction/forum/topic.php?id=5864 http://www.openwall.com/lists/oss-security/2013/10/15/1 http://www.openwall.com/lists/oss-security/2013/10/16/7 https://bugs.launchpad.net/mahara/+bug/1034180	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4431`	vulnerable	2026-06-08 05:04:46.702569	Details available Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allows remote authenticated users to modify arbitrary blocks via the bock id in an edit request. Published: 2014-05-19T14:00:00.000Z Updated: 2024-08-06T16:45:13.487Z Open on db.gcve.eu Reference links https://mahara.org/interaction/forum/topic.php?id=5753 http://www.openwall.com/lists/oss-security/2013/10/08/3 http://www.openwall.com/lists/oss-security/2013/10/15/1 http://www.openwall.com/lists/oss-security/2013/10/16/7 https://bugs.launchpad.net/mahara/+bug/1233500	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4430`	vulnerable	2026-06-08 05:04:46.693460	Details available Cross-site scripting (XSS) vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inject arbitrary web script or HTML via the Host header to lib/web.php. Published: 2014-05-19T14:00:00.000Z Updated: 2024-08-06T16:45:13.343Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/1175446 http://www.openwall.com/lists/oss-security/2013/10/08/3 https://mahara.org/interaction/forum/topic.php?id=5754 http://www.openwall.com/lists/oss-security/2013/10/15/1 http://www.openwall.com/lists/oss-security/2013/10/16/7	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4429`	vulnerable	2026-06-08 05:04:36.186785	Details available Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict access to artefacts, which allows remote authenticated users to read arbitrary artefacts via the (1) artefact id in an upload action when creating a journal or (2) instconf_artefactid_selected[ID] parameter in an upload action when editing a block. Published: 2014-05-19T14:00:00.000Z Updated: 2024-08-06T16:45:13.850Z Open on db.gcve.eu Reference links https://mahara.org/interaction/forum/topic.php?id=5753 http://www.openwall.com/lists/oss-security/2013/10/08/3 http://www.openwall.com/lists/oss-security/2013/10/15/1 https://bugs.launchpad.net/mahara/+bug/1211758 http://www.openwall.com/lists/oss-security/2013/10/16/7	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.