CVE-2011-0440

Cross-site request forgery (CSRF) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs.

Published Bycve@mitre.org

Published DateMar 28, 2011, 16:55

Weakness Type (CWE):CWE-352

CVSS Metrics

Base Score

5.8

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://mahara.org/interaction/forum/topic.php?id=3206
http://mahara.org/interaction/forum/topic.php?id=3208
http://secunia.com/advisories/43858
http://www.debian.org/security/2011/dsa-2206
http://www.securityfocus.com/bid/47033
https://exchange.xforce.ibmcloud.com/vulnerabilities/66326

Weakness Type (CWE):CWE-352

CVSS Metrics

Base Score

5.8

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

PARTIAL