diff options
| author | Niels Heinen <niels@FreeBSD.org> | 2010-04-18 19:00:29 +0000 |
|---|---|---|
| committer | Niels Heinen <niels@FreeBSD.org> | 2010-04-18 19:00:29 +0000 |
| commit | 829d453ca4d3a2a718c6bc9c254c7408ba932e96 (patch) | |
| tree | e05618031c1779a21e0774731f00ada984f081b7 /security/vuxml/vuln.xml | |
| parent | 39db6303dbc0bcec0c02ff537161d10608892611 (diff) | |
| download | ports-829d453ca4d3a2a718c6bc9c254c7408ba932e96.tar.gz ports-829d453ca4d3a2a718c6bc9c254c7408ba932e96.zip | |
Document mahara sql injection vulnerability
Approved by: remko (secteam)
Security: http://www.debian.org/security/2010/dsa-2030
Notes
Notes:
svn path=/head/; revision=252879
Diffstat (limited to 'security/vuxml/vuln.xml')
| -rw-r--r-- | security/vuxml/vuln.xml | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index cd13b1902f15..54358f2a5c2e 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -34,6 +34,38 @@ Note: Please add new entries to the beginning of this file. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="5053420c-4935-11df-83fb-0015587e2cc1"> + <topic>mahara -- sql injection vulnerability</topic> + <affects> + <package> + <name>mahara</name> + <range><lt>1.1.8</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>The Debian security team reports:</p> + <blockquote cite="http://www.debian.org/security/2010/dsa-2030"> + <p>It was discovered that mahara, an electronic portfolio, + weblog, and resume builder is not properly escaping input + when generating a unique username based on a remote user + name from a single sign-on application. An attacker can use + this to compromise the mahara database via crafted user + names.</p> + </blockquote> + </body> + </description> + <references> + <bid>39253</bid> + <cvename>CVE-2010-0400</cvename> + <url>http://www.debian.org/security/2010/dsa-2030</url> + </references> + <dates> + <discovery>2010-04-06</discovery> + <entry>2010-04-18</entry> + </dates> + </vuln> + <vuln vid="1a9f678d-48ca-11df-85f8-000c29a67389"> <topic>sudo -- Privilege escalation with sudoedit</topic> <affects> |