Mahara Multiple Security Bypass Vulnerabilities

Bugtraq ID:	62862
Class:	Access Validation Error
CVE:	CVE-2013-4429 CVE-2013-4431 CVE-2013-4432
Remote:	Yes
Local:	No
Published:	Oct 03 2013 12:00AM
Updated:	Mar 19 2015 09:10AM
Credit:	Vendor and Tom Forbes
Vulnerable:	Mahara Mahara 1.4.1 Mahara Mahara 1.4 Mahara Mahara 1.3.6 Mahara Mahara 1.3.5 Mahara Mahara 1.3.4 Mahara Mahara 1.3.3 Mahara Mahara 1.2.4 Mahara Mahara 1.2.3 Mahara Mahara 1.1.9 Mahara Mahara 1.1.8 Mahara Mahara 1.1.7 Mahara Mahara 1.1.6 Mahara Mahara 1.1.5 Mahara Mahara 1.1.4 Mahara Mahara 1.1.3 Mahara Mahara 1.1.2 Mahara Mahara 1.1.1 Mahara Mahara 1.0.15 Mahara Mahara 1.0.14 Mahara Mahara 1.0.13 Mahara Mahara 1.0.12 Mahara Mahara 1.0.11 Mahara Mahara 1.0.10 Mahara Mahara 1.0.9 Mahara Mahara 1.0.8 Mahara Mahara 1.0.7 Mahara Mahara 1.0.6 Mahara Mahara 1.0.5 Mahara Mahara 1.0.4 Mahara Mahara 1.0.3 Mahara Mahara 1.0.2 Mahara Mahara 1.0.1 Mahara Mahara 1.0 Mahara Mahara 0.9.1 Mahara Mahara 0.9 Mahara Mahara 1.3.2 Mahara Mahara 1.3.1 Mahara Mahara 1.3.0 Mahara Mahara 1.2.7 Mahara Mahara 1.2.6 Mahara Mahara 1.2.5 Mahara Mahara 1.2.2 Mahara Mahara 1.2.1 Mahara Mahara 1.2.0 Mahara Mahara 1.1.0 Mahara Mahara 0.9.2
Not Vulnerable:

Mahara Multiple Security Bypass Vulnerabilities

Mahara is prone to multiple security-bypass vulnerabilities.

Attackers can exploit these issues to obtain sensitive information or perform unauthorized actions. This may aid in further attacks.

Mahara versions prior to 1.5.12, 1.6.7, and 1.7.3 are vulnerable.

Mahara Multiple Security Bypass Vulnerabilities

Attackers can exploit these issues with a browser.

Mahara Multiple Security Bypass Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Mahara Multiple Security Bypass Vulnerabilities

References:

• Mahara Homepage (Mahara)
  
• Multiple Access Control Vulnerabilities in <1.5.12, <1.6.7, <1.7.3 (Mahara)
  
• Not checking ownership of blocks before editing them (Mahara)
  
• Arbitrary image download (Mahara)