mahara: multiple vulnerabilities
| Package(s): | mahara | CVE #(s): | CVE-2010-1667 CVE-2010-1668 CVE-2010-1670 CVE-2010-2479 | ||||||||||||
| Created: | July 2, 2010 | Updated: | August 23, 2010 | ||||||||||||
| Description: | From the Debian advisory:
Several vulnerabilities were discovered in mahara, an electronic portfolio, weblog, and resume builder. The following Common Vulnerabilities and Exposures project ids identify them: Multiple pages performed insufficient input sanitising, making them vulnerable to cross-site scripting attacks. (CVE-2010-1667) Multiple forms lacked protection against cross-site request forgery attacks, therefore making them vulnerable. (CVE-2010-1668) Gregor Anzelj discovered that it was possible to accidentally configure an installation of mahara that allows access to another user's account without a password. (CVE-2010-1670) Certain Internet Explorer-specific cross-site scripting vulnerabilities were discovered in HTML Purifier, of which a copy is included in the mahara package. (CVE-2010-2479) | ||||||||||||||
| Alerts: |
| ||||||||||||||