CVE-2011-1404

Publication date 13 May 2011

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Description

Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with (1) blocktype/myfriends/myfriends.json.php, (2) json/usersearch.php, (3) group/membersearchresults.json.php, or (4) json/friendsearch.php, as demonstrated by information about friends and e-mail addresses.

Status

Package Ubuntu Release Status
mahara 11.04 natty
Fixed 1.2.7-1ubuntu0.1
10.10 maverick
Fixed 1.2.5-2ubuntu0.2
10.04 LTS lucid
Fixed 1.2.4-1ubuntu0.3
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release

References

Other references

Access our resources on patching vulnerabilities