medium4.0
CVE-2011-1404
Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via…
Impact
Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with (1) blocktype/myfriends/myfriends.json.php, (2) json/usersearch.php, (3) group/membersearchresults.json.php, or (4) json/friendsearch.php, as demonstrated by information about friends and e-mail addresses.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mahara | Mahara | through 1.3.5 Versions 0.9.0, 0.9.1, 0.9.2, 1.0.0, 1.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://secunia.com/advisories/44433
- http://www.debian.org/security/2011/dsa-2246
- http://www.securityfocus.com/bid/47798
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67395
- https://launchpad.net/mahara/+bug/772140
- https://launchpad.net/mahara/+bug/772160
- https://launchpad.net/mahara/+bug/772174
- https://launchpad.net/mahara/+bug/772179
- https://launchpad.net/mahara/+milestone/1.3.6
- http://secunia.com/advisories/44433
- http://www.debian.org/security/2011/dsa-2246
- http://www.securityfocus.com/bid/47798
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67395
- https://launchpad.net/mahara/+bug/772140
- https://launchpad.net/mahara/+bug/772160
- https://launchpad.net/mahara/+bug/772174
- https://launchpad.net/mahara/+bug/772179
- https://launchpad.net/mahara/+milestone/1.3.6