Vulnerabilities > Mahara > Mahara > 15.04.10

DATE CVE VULNERABILITY TITLE RISK
2022-04-28 CVE-2022-28892 Cross-Site Request Forgery (CSRF) vulnerability in Mahara
Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessable.
network
low complexity
mahara CWE-352
8.8
2022-04-28 CVE-2022-29584 Cross-site Scripting vulnerability in Mahara
Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action.
network
mahara CWE-79
3.5
2022-04-28 CVE-2022-29585 Incorrect Default Permissions vulnerability in Mahara
In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used.
network
low complexity
mahara CWE-276
5.0
2021-11-03 CVE-2021-40848 Improper Neutralization of Formula Elements in a CSV File vulnerability in Mahara
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection.
network
mahara CWE-1236
6.8
2021-11-03 CVE-2021-40849 Insufficient Session Expiration vulnerability in Mahara
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.
network
low complexity
mahara CWE-613
7.5
2018-01-30 CVE-2017-1000141 Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mahara
An issue was discovered in Mahara before 18.10.0.
network
low complexity
mahara CWE-640
6.4
2017-11-03 CVE-2017-1000157 Information Exposure vulnerability in Mahara
Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the event_log table during the user creation process if full event logging was turned on.
network
mahara CWE-200
3.5
2017-10-31 CVE-2017-15273 Cross-site Scripting vulnerability in Mahara
Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as titles in internal artefacts.
network
mahara CWE-79
3.5
2017-10-31 CVE-2017-14752 Cross-site Scripting vulnerability in Mahara
Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as their first name, last name, or display name in the profile fields that can cause issues such as escalation of privileges or unknown execution of malicious code when replying to messages in Mahara.
network
mahara CWE-79
3.5
2017-10-31 CVE-2017-14163 Session Fixation vulnerability in Mahara
An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3.
network
low complexity
mahara CWE-384
6.5