Forums | Mahara Community

Security Announcements /
CSRF in Mahara 1.2.6 and 1.3.3

This topic is closed. Only moderators and the group administrators can post new replies.

24 March 2011, 20:15

Category: Cross-site request forgery
Severity: High
Versions affected: < 1.2.7, < 1.3.4
Reported by: Mahara Team
Identifier: CVE-2011-0440

A missing session key check allowed attackers to delete other people's blogs through specially crafted links.

Upgrading to Mahara 1.2.7 or 1.3.4 is strongly recommended for all sites.

1 result