CVE-2012-2246
Mahara 1.4.x < 1.4.5 and 1.5.x < 1.5.4 - Clickjacking and CSRF Bypass via Account Deletion
Title source: llmDescription
Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4 allows remote attackers to conduct clickjacking attacks to delete arbitrary users and bypass CSRF protection via account/delete.php.
References (4)
Core 4
Core References
Issue Tracking x_refsource_confirm
https://bugs.launchpad.net/mahara/+bug/1057240
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2012/dsa-2591
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79273
Vendor Advisory x_refsource_confirm
https://mahara.org/interaction/forum/topic.php?id=4939
Scores
EPSS
0.0134
EPSS Percentile
68.0%
Details
CWE
CWE-20
Status
published
Products (11)
mahara/mahara
1.4 rc1 (4 CPE variants)
mahara/mahara
1.4.0
mahara/mahara
1.4.1
mahara/mahara
1.4.2
mahara/mahara
1.4.3
mahara/mahara
1.4.4
mahara/mahara
1.5 rc1 (2 CPE variants)
mahara/mahara
1.5.0
mahara/mahara
1.5.1
mahara/mahara
1.5.2
... and 1 more
Published
Nov 24, 2012
Tracked Since
Feb 18, 2026