PT-2018-10672 · Catalyst It · Mahara

Steven Spinelli · Published 2018-05-30 · Updated 2018-07-03 · CVE-2018-11565

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mahara versions 17.04 through 17.04.7 Mahara versions 17.10 through 17.10.4 Mahara versions 18.04 through 18.04.0

Description The issue allows the mentioning of usernames that are already taken by people registered in the system, rather than masking that information.

Recommendations For Mahara versions 17.04 through 17.04.7, update to version 17.04.8 to resolve the issue. For Mahara versions 17.10 through 17.10.4, update to version 17.10.5 to resolve the issue. For Mahara versions 18.04 through 18.04.0, update to version 18.04.1 to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-11565

Affected Products

Mahara

References · 5

• https://bugs.launchpad.net/mahara/+bug/1772774 · Vendor Advisory
• https://mahara.org/interaction/forum/topic.php?id=8271 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11565 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11565 · Note