CVE-2012-2351 | BDVDB-2026-50900 Detail

Description#

The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://bugs.launchpad.net/mahara/+bug/932909
http://gitorious.org/mahara/mahara/commit/f07be6020e70fa8f53cd77fdcd63e7fd7ff8aaea
http://www.debian.org/security/2012/dsa-2467
http://www.openwall.com/lists/oss-security/2012/05/11/9
http://www.openwall.com/lists/oss-security/2012/05/12/4

Exploit#

No public exploit known

History#

Version 12012-07-12Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.