VulnerabilityModified
CVE-2012-2246
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php.
MEDIUM 6.8EPSS 1.34%
Does this matter?
Lower severity and a low EPSS score (1.34%). Track it; it rarely justifies an emergency change on its own.
Description
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 1.34% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- mahara/mahara
- Source
- security@debian.org
References
- http://www.debian.org/security/2012/dsa-2591
- https://bugs.launchpad.net/mahara/+bug/1057240
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79273
- https://mahara.org/interaction/forum/topic.php?id=4939Vendor Advisory
- http://www.debian.org/security/2012/dsa-2591
- https://bugs.launchpad.net/mahara/+bug/1057240
- https://exchange.xforce.ibmcloud.com/vulnerabilities/79273
- https://mahara.org/interaction/forum/topic.php?id=4939Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.