PT-2011-3104 · Catalyst It · Mahara

Ruslan Kabalin · Published 2011-05-13 · Updated 2017-08-17 · CVE-2011-1406

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 1.3.6

Description The issue arises from improper handling of an https URL in the wwwroot configuration setting. This makes it easier for remote attackers to obtain credentials by sniffing the network when an http URL is used for a login.

Recommendations For versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the login functionality over http to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2011-1406

DSA-2246-1

Affected Products

Mahara

References · 6

• https://launchpad.net/mahara/+milestone/1.3.6 · Patch
• https://launchpad.net/mahara/+bug/685942 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-1406 · Security Note
• http://debian.org/security/2011/dsa-2246 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/67400 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1406 · Note