Description
Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox.
Exploits (1)
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/0xBaz/CVE-2021-29349/issues/1
Scores
CVSS v3
6.5
EPSS
0.0039
EPSS Percentile
59.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Details
CWE
CWE-352
Status
published
Products (1)
mahara/mahara
20.10
Published
Mar 31, 2021
Tracked Since
Feb 18, 2026