Mahara Reply To Message Information Disclosure Vulnerability

Bugtraq ID:	50698
Class:	Unknown
CVE:	CVE-2011-2774
Remote:	Yes
Local:	No
Published:	Nov 07 2011 12:00AM
Updated:	Nov 07 2011 12:00AM
Credit:	Teemu Vesala
Vulnerable:	Mahara Mahara 1.4 Mahara Mahara 1.3.6 Mahara Mahara 1.3.5 Mahara Mahara 1.3.4 Mahara Mahara 1.3.3 Mahara Mahara 1.3.3 Mahara Mahara 1.3 beta3 Mahara Mahara 1.3 beta2 Mahara Mahara 1.3 beta1 Mahara Mahara 1.2.5 Mahara Mahara 1.2.4 Mahara Mahara 1.2.3 Mahara Mahara 1.3.2 Mahara Mahara 1.3.1 Mahara Mahara 1.3.0 RC1 Mahara Mahara 1.3.0 Beta4 Mahara Mahara 1.3.0 Mahara Mahara 1.2.7 Mahara Mahara 1.2.6 Mahara Mahara 1.2.5 Mahara Mahara 1.2.2 Mahara Mahara 1.2.1 Mahara Mahara 1.2.0
Not Vulnerable:	Mahara Mahara 1.4.1

Mahara Reply To Message Information Disclosure Vulnerability

Mahara is prone to an information-disclosure vulnerability because it fails to properly check user permissions before performing certain actions.

An attacker can exploit this issue to gain access to sensitive information. Information obtained may lead to further attacks.

Versions prior to Mahara 1.4.1 are vulnerable.

Mahara Reply To Message Information Disclosure Vulnerability

Attackers can exploit this issue through a browser.

Mahara Reply To Message Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for details.

Mahara Reply To Message Information Disclosure Vulnerability

References:

• Mahara Homepage (Mahara)
  
• Security Announcements - Information disclosure in Mahara 1.1.4 (Francois Marier)