VulnerabilityModified
CVE-2011-1403
Cross-site request forgery (CSRF) vulnerability in the pieforms implementation in Mahara before 1.3.6 allows remote attackers to hijack the authentication of arbitrary users for requests to any form, related to inappropriate regeneration of session keys.
MEDIUM 6.8EPSS 1.03%
Does this matter?
Lower severity and a low EPSS score (1.03%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site request forgery (CSRF) vulnerability in the pieforms implementation in Mahara before 1.3.6 allows remote attackers to hijack the authentication of arbitrary users for requests to any form, related to inappropriate regeneration of session keys.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.03% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-352
- Affected
- mahara/mahara
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/44433Vendor Advisory
- http://www.debian.org/security/2011/dsa-2246
- http://www.securityfocus.com/bid/47798
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67398
- https://launchpad.net/mahara/+bug/771598Patch
- https://launchpad.net/mahara/+milestone/1.3.6Patch
- http://secunia.com/advisories/44433Vendor Advisory
- http://www.debian.org/security/2011/dsa-2246
- http://www.securityfocus.com/bid/47798
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67398
- https://launchpad.net/mahara/+bug/771598Patch
- https://launchpad.net/mahara/+milestone/1.3.6Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.