Security Advisory

CVE-2011-1404

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2011-05-13 22:00:00

Last updated 2024-08-06 22:28:40

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with (1) blocktype/myfriends/myfriends.json.php, (2) json/usersearch.php, (3) group/membersearchresults.json.php, or (4) json/friendsearch.php, as demonstrated by information about friends and e-mail addresses.

← Browse all CVEs View on cve.org ↗