CVE-2012-2351

Published Jul 12, 2012 CVSS 2.0 · 5.0 Medium EPSS 2.1% KEV · Not listed
Description
The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2012-2344 The default configuration of the auth/saml plugin in Mahara before 1.4.2 sets the "Match username attribute to Remote username" option to false, which allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Sep 16, 2024, 5:22 PM
Reserved
Apr 19, 2012, 12:00 AM
Status
Modified
Published
Jul 12, 2012, 8:55 PM
Modified
Jun 16, 2026, 11:41 PM