PT-2010-3330 · Catalyst It · Mahara

Published 2010-07-06 · Updated 2010-07-07 · CVE-2010-1670

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mahara versions 1.0.0 through 1.0.14 Mahara versions 1.1.0 through 1.1.8 Mahara versions 1.2.0 through 1.2.4

Description The issue is related to improper configuration options for authentication plugins associated with logins that use the single sign-on (SSO) functionality. This allows remote attackers to bypass authentication via an empty password.

Recommendations For Mahara versions 1.0.0 through 1.0.14, update to version 1.0.15 or later. For Mahara versions 1.1.0 through 1.1.8, update to version 1.1.9 or later. For Mahara versions 1.2.0 through 1.2.4, update to version 1.2.5 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-1670

DSA-2067-1

Affected Products

Mahara

References · 7

• http://secunia.com/advisories/40431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-1670 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1670 · Note
• http://securityfocus.com/bid/41319 · Note
• http://wiki.mahara.org/Release_Notes/1.2.5 · Note
• http://wiki.mahara.org/Release_Notes/1.1.9 · Note
• http://wiki.mahara.org/Release_Notes/1.0.15 · Note