Mahara CVE-2011-2773 Cross Site Request Forgery Vulnerability

Bugtraq ID:	50544
Class:	Design Error
CVE:	CVE-2011-2773
Remote:	Yes
Local:	No
Published:	Nov 04 2011 12:00AM
Updated:	Mar 19 2015 08:27AM
Credit:	Richard Mansfield
Vulnerable:	Mahara Mahara 1.3.6 Mahara Mahara 1.3.5 Mahara Mahara 1.3.4 Mahara Mahara 1.3.3 Mahara Mahara 1.3 beta3 Mahara Mahara 1.3 beta2 Mahara Mahara 1.3 beta1 Mahara Mahara 1.2.5 Mahara Mahara 1.2.4 Mahara Mahara 1.2.3 Mahara Mahara 1.2 RC1 Mahara Mahara 1.2 beta4 Mahara Mahara 1.2 beta3 Mahara Mahara 1.2 beta1 Mahara Mahara 1.2 Beta Mahara Mahara 1.1.9 Mahara Mahara 1.1.8 Mahara Mahara 1.1.7 Mahara Mahara 1.1.6 Mahara Mahara 1.1.5 Mahara Mahara 1.1.4 Mahara Mahara 1.1.3 Mahara Mahara 1.1.2 Mahara Mahara 1.1.1 Mahara Mahara 1.1 Beta4 Mahara Mahara 1.1 Beta3 Mahara Mahara 1.1 Beta2 Mahara Mahara 1.0.15 Mahara Mahara 1.0.14 Mahara Mahara 1.0.13 Mahara Mahara 1.0.12 Mahara Mahara 1.0.11 Mahara Mahara 1.0.10 Mahara Mahara 1.0.9 Mahara Mahara 1.0.8 Mahara Mahara 1.0.7 Mahara Mahara 1.0.6 Mahara Mahara 1.0.5 Mahara Mahara 1.0.4 Mahara Mahara 1.0.3 Mahara Mahara 1.0.2 Mahara Mahara 1.0.1 Mahara Mahara 1.0 Mahara Mahara 0.9.1 Mahara Mahara 0.9 Mahara Mahara 1.3.2 Mahara Mahara 1.3.1 Mahara Mahara 1.3.0 RC1 Mahara Mahara 1.3.0 Beta4 Mahara Mahara 1.3.0 Mahara Mahara 1.2.7 Mahara Mahara 1.2.6 Mahara Mahara 1.2.5 Mahara Mahara 1.2.2 Mahara Mahara 1.2.1 Mahara Mahara 1.2.0 Alpha3 Mahara Mahara 1.2.0 Alpha2 Mahara Mahara 1.2.0 Alpha1 Mahara Mahara 1.2.0 Mahara Mahara 1.1.0 Rc2 Mahara Mahara 1.1.0 Rc1 Mahara Mahara 1.1.0 Beta1 Mahara Mahara 1.1.0 Alpha3 Mahara Mahara 1.1.0 Alpha2 Mahara Mahara 1.1.0 Alpha1 Mahara Mahara 1.1.0 Mahara Mahara 1.1 Mahara Mahara 0.9.2 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:	Mahara Mahara 1.4.1

Mahara CVE-2011-2773 Cross Site Request Forgery Vulnerability

Mahara is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Versions prior to Mahara 1.4.1 are vulnerable.

Mahara CVE-2011-2773 Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.

Mahara CVE-2011-2773 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the reference for more details.

Mahara CVE-2011-2773 Cross Site Request Forgery Vulnerability

References:

• [SECURITY] [DSA 2334-1] mahara security update (Full Disclosure)
  
• Mahara 1.4.1 Release Notes (Mahara)
  
• Mahara Homepage (Mahara)