5

CVE-2012-2351

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 6.0
Mahara ≫ Mahara Version <= 1.4.1
Mahara ≫ Mahara Version 0.9.0
Mahara ≫ Mahara Version 0.9.1
Mahara ≫ Mahara Version 0.9.2
Mahara ≫ Mahara Version 1.0.0
Mahara ≫ Mahara Version 1.0.1
Mahara ≫ Mahara Version 1.0.2
Mahara ≫ Mahara Version 1.0.3
Mahara ≫ Mahara Version 1.0.4
Mahara ≫ Mahara Version 1.0.5
Mahara ≫ Mahara Version 1.0.6
Mahara ≫ Mahara Version 1.0.7
Mahara ≫ Mahara Version 1.0.8
Mahara ≫ Mahara Version 1.0.9
Mahara ≫ Mahara Version 1.0.10
Mahara ≫ Mahara Version 1.0.11
Mahara ≫ Mahara Version 1.0.12
Mahara ≫ Mahara Version 1.0.13
Mahara ≫ Mahara Version 1.0.14
Mahara ≫ Mahara Version 1.0.15
Mahara ≫ Mahara Version 1.1
Mahara ≫ Mahara Version 1.1.0
Mahara ≫ Mahara Version 1.1.0 Update alpha1
Mahara ≫ Mahara Version 1.1.0 Update alpha2
Mahara ≫ Mahara Version 1.1.0 Update alpha3
Mahara ≫ Mahara Version 1.1.0 Update beta1
Mahara ≫ Mahara Version 1.1.0 Update beta2
Mahara ≫ Mahara Version 1.1.0 Update beta3
Mahara ≫ Mahara Version 1.1.0 Update beta4
Mahara ≫ Mahara Version 1.1.0 Update rc1
Mahara ≫ Mahara Version 1.1.0 Update rc2
Mahara ≫ Mahara Version 1.1.1
Mahara ≫ Mahara Version 1.1.2
Mahara ≫ Mahara Version 1.1.3
Mahara ≫ Mahara Version 1.1.4
Mahara ≫ Mahara Version 1.1.5
Mahara ≫ Mahara Version 1.1.6
Mahara ≫ Mahara Version 1.1.7
Mahara ≫ Mahara Version 1.1.8
Mahara ≫ Mahara Version 1.1.9
Mahara ≫ Mahara Version 1.2.0
Mahara ≫ Mahara Version 1.2.0 Update alpha1
Mahara ≫ Mahara Version 1.2.0 Update alpha2
Mahara ≫ Mahara Version 1.2.0 Update alpha3
Mahara ≫ Mahara Version 1.2.0 Update beta1
Mahara ≫ Mahara Version 1.2.0 Update beta2
Mahara ≫ Mahara Version 1.2.0 Update beta3
Mahara ≫ Mahara Version 1.2.0 Update beta4
Mahara ≫ Mahara Version 1.2.0 Update rc1
Mahara ≫ Mahara Version 1.2.1
Mahara ≫ Mahara Version 1.2.2
Mahara ≫ Mahara Version 1.2.3
Mahara ≫ Mahara Version 1.2.4
Mahara ≫ Mahara Version 1.2.5
Mahara ≫ Mahara Version 1.2.6
Mahara ≫ Mahara Version 1.3.0
Mahara ≫ Mahara Version 1.3.0 Update beta1
Mahara ≫ Mahara Version 1.3.0 Update beta2
Mahara ≫ Mahara Version 1.3.0 Update beta3
Mahara ≫ Mahara Version 1.3.0 Update beta4
Mahara ≫ Mahara Version 1.3.0 Update rc1
Mahara ≫ Mahara Version 1.3.1
Mahara ≫ Mahara Version 1.3.2
Mahara ≫ Mahara Version 1.3.3
Mahara ≫ Mahara Version 1.3.4
Mahara ≫ Mahara Version 1.3.5
Mahara ≫ Mahara Version 1.3.6
Mahara ≫ Mahara Version 1.3.7
Mahara ≫ Mahara Version 1.3.8
Mahara ≫ Mahara Version 1.4 Update rc1
Mahara ≫ Mahara Version 1.4 Update rc2
Mahara ≫ Mahara Version 1.4 Update rc3
Mahara ≫ Mahara Version 1.4 Update rc4
Mahara ≫ Mahara Version 1.4.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.07% 0.79
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:P/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://gitorious.org/mahara/mahara/commit/f07be6020e70fa8f53cd77fdcd63e7fd7ff8aaea
Patch
Issue Tracking
http://www.debian.org/security/2012/dsa-2467
Third Party Advisory
http://www.openwall.com/lists/oss-security/2012/05/11/9
Third Party Advisory
Mailing List
http://www.openwall.com/lists/oss-security/2012/05/12/4
Third Party Advisory
Mailing List
https://bugs.launchpad.net/mahara/+bug/932909
Issue Tracking