CVE-2011-1406 Misconfiguration in n/a
Attackers can sniff credentials if Mahara is misconfigured to use HTTP for login despite HTTPS settings, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2011-1406?
CVE-2011-1406 is a medium-severity vulnerability in Mahara Mahara, published on 13 May 2011. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Mahara before 1.3.6 does not properly handle an https URL in the wwwroot configuration setting, which makes it easier for user-assisted remote attackers to obtain credentials by sniffing the network at a time when an http URL is used for a login.
Weakness: CWE-16
Which versions are affected by CVE-2011-1406?
It affects 1 product.
Products include Mahara Mahara.
How do I fix CVE-2011-1406?
Upgrade to a fixed version.
Is CVE-2011-1406 being exploited?
There is no known exploitation of CVE-2011-1406 in the wild and no public exploit code.
Other vulnerabilities in Mahara Mahara
Sources
Also known as GHSA-hr4m-fxpj-q7hc.