CVE-2012-2351
Summary
| CVE | CVE-2012-2351 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-07-12 20:55:15 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username. |
Risk And Classification
Primary CVSS: v2.0 5 from [email protected]
AV:N/AC:L/Au:N/C:N/I:P/A:N
Problem Types: CWE-16 | CWE-284 | CWE-287 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:L/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 6.0 | All | All | All |
| Application | Mahara | Mahara | 0.9.0 | All | All | All |
| Application | Mahara | Mahara | 0.9.1 | All | All | All |
| Application | Mahara | Mahara | 0.9.2 | All | All | All |
| Application | Mahara | Mahara | 1.0.0 | All | All | All |
| Application | Mahara | Mahara | 1.0.1 | All | All | All |
| Application | Mahara | Mahara | 1.0.10 | All | All | All |
| Application | Mahara | Mahara | 1.0.11 | All | All | All |
| Application | Mahara | Mahara | 1.0.12 | All | All | All |
| Application | Mahara | Mahara | 1.0.13 | All | All | All |
| Application | Mahara | Mahara | 1.0.14 | All | All | All |
| Application | Mahara | Mahara | 1.0.15 | All | All | All |
| Application | Mahara | Mahara | 1.0.2 | All | All | All |
| Application | Mahara | Mahara | 1.0.3 | All | All | All |
| Application | Mahara | Mahara | 1.0.4 | All | All | All |
| Application | Mahara | Mahara | 1.0.5 | All | All | All |
| Application | Mahara | Mahara | 1.0.6 | All | All | All |
| Application | Mahara | Mahara | 1.0.7 | All | All | All |
| Application | Mahara | Mahara | 1.0.8 | All | All | All |
| Application | Mahara | Mahara | 1.0.9 | All | All | All |
| Application | Mahara | Mahara | 1.1 | All | All | All |
| Application | Mahara | Mahara | 1.1.0 | All | All | All |
| Application | Mahara | Mahara | 1.1.0 | alpha1 | All | All |
| Application | Mahara | Mahara | 1.1.0 | alpha2 | All | All |
| Application | Mahara | Mahara | 1.1.0 | alpha3 | All | All |
| Application | Mahara | Mahara | 1.1.0 | beta1 | All | All |
| Application | Mahara | Mahara | 1.1.0 | beta2 | All | All |
| Application | Mahara | Mahara | 1.1.0 | beta3 | All | All |
| Application | Mahara | Mahara | 1.1.0 | beta4 | All | All |
| Application | Mahara | Mahara | 1.1.0 | rc1 | All | All |
| Application | Mahara | Mahara | 1.1.0 | rc2 | All | All |
| Application | Mahara | Mahara | 1.1.1 | All | All | All |
| Application | Mahara | Mahara | 1.1.2 | All | All | All |
| Application | Mahara | Mahara | 1.1.3 | All | All | All |
| Application | Mahara | Mahara | 1.1.4 | All | All | All |
| Application | Mahara | Mahara | 1.1.5 | All | All | All |
| Application | Mahara | Mahara | 1.1.6 | All | All | All |
| Application | Mahara | Mahara | 1.1.7 | All | All | All |
| Application | Mahara | Mahara | 1.1.8 | All | All | All |
| Application | Mahara | Mahara | 1.1.9 | All | All | All |
| Application | Mahara | Mahara | 1.2.0 | All | All | All |
| Application | Mahara | Mahara | 1.2.0 | alpha1 | All | All |
| Application | Mahara | Mahara | 1.2.0 | alpha2 | All | All |
| Application | Mahara | Mahara | 1.2.0 | alpha3 | All | All |
| Application | Mahara | Mahara | 1.2.0 | beta1 | All | All |
| Application | Mahara | Mahara | 1.2.0 | beta2 | All | All |
| Application | Mahara | Mahara | 1.2.0 | beta3 | All | All |
| Application | Mahara | Mahara | 1.2.0 | beta4 | All | All |
| Application | Mahara | Mahara | 1.2.0 | rc1 | All | All |
| Application | Mahara | Mahara | 1.2.1 | All | All | All |
| Application | Mahara | Mahara | 1.2.2 | All | All | All |
| Application | Mahara | Mahara | 1.2.3 | All | All | All |
| Application | Mahara | Mahara | 1.2.4 | All | All | All |
| Application | Mahara | Mahara | 1.2.5 | All | All | All |
| Application | Mahara | Mahara | 1.2.6 | All | All | All |
| Application | Mahara | Mahara | 1.3.0 | All | All | All |
| Application | Mahara | Mahara | 1.3.0 | beta1 | All | All |
| Application | Mahara | Mahara | 1.3.0 | beta2 | All | All |
| Application | Mahara | Mahara | 1.3.0 | beta3 | All | All |
| Application | Mahara | Mahara | 1.3.0 | beta4 | All | All |
| Application | Mahara | Mahara | 1.3.0 | rc1 | All | All |
| Application | Mahara | Mahara | 1.3.1 | All | All | All |
| Application | Mahara | Mahara | 1.3.2 | All | All | All |
| Application | Mahara | Mahara | 1.3.3 | All | All | All |
| Application | Mahara | Mahara | 1.3.4 | All | All | All |
| Application | Mahara | Mahara | 1.3.5 | All | All | All |
| Application | Mahara | Mahara | 1.3.6 | All | All | All |
| Application | Mahara | Mahara | 1.3.7 | All | All | All |
| Application | Mahara | Mahara | 1.3.8 | All | All | All |
| Application | Mahara | Mahara | 1.4 | rc1 | All | All |
| Application | Mahara | Mahara | 1.4 | rc2 | All | All |
| Application | Mahara | Mahara | 1.4 | rc3 | All | All |
| Application | Mahara | Mahara | 1.4 | rc4 | All | All |
| Application | Mahara | Mahara | 1.4.0 | All | All | All |
| Application | Mahara | Mahara | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Debian -- Security Information -- DSA-2467-1 mahara | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | Third Party Advisory |
| oss-security - Re: CVE request: mahara | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Third Party Advisory |
| oss-security - CVE request: mahara | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Third Party Advisory |
| Bug #932909 “auth/saml default remoteuser” : Bugs : Mahara | af854a3a-2127-422b-91ae-364da2661108 | bugs.launchpad.net | Issue Tracking |
| gitorious.org Git - mahara:mahara.git/commit | af854a3a-2127-422b-91ae-364da2661108 | gitorious.org | Issue Tracking, Patch |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.