PT-2012-3972 · Catalyst It · Mahara

Piers Harding + 1 · Publicado 2012-07-12 · Atualizado 2016-12-07 · CVE-2012-2351

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.4.2

Description The default configuration of the auth/saml plugin in Mahara allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username, due to the "Match username attribute to Remote username" option being set to false.

Recommendations For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider setting the "Match username attribute to Remote username" option to true to prevent user spoofing.

Correção

Improper Authentication

Improper Access Control

Enumeração de Fraquezas

CWE-287

CWE-16

CWE-284

Identificadores relacionados

CVE-2012-2351

DSA-2467-1

Produtos afetados

Mahara

Referências · 7

• https://bugs.launchpad.net/mahara/+bug/932909 · Nota
• http://openwall.com/lists/oss-security/2012/05/12/4 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2351 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2351 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/05/11/9 · Nota
• http://debian.org/security/2012/dsa-2467 · Aviso do Fabricante
• http://gitorious.org/mahara/mahara/commit/f07be6020e70fa8f53cd77fdcd63e7fd7ff8aaea · Correção