Description
Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with (1) blocktype/myfriends/myfriends.json.php, (2) json/usersearch.php, (3) group/membersearchresults.json.php, or (4) json/friendsearch.php, as demonstrated by information about friends and e-mail addresses.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | mahara | 1.2.6-2+squeeze2 | DSA-2246-1 |
| Debian 5.0 | mahara | 1.0.4-4+lenny10 | DSA-2246-1 |
Advisories 1
- DSA-2246-1 mahara - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://launchpad.net/mahara/+milestone/1.3.6
- https://launchpad.net/mahara/+bug/772179
- mahara-viewtasksjson-sec-bypass(67395) vdb-entry
- https://launchpad.net/mahara/+bug/772140
- 47798 vdb-entry
- 44433 third-party-advisory
- https://launchpad.net/mahara/+bug/772174
- https://launchpad.net/mahara/+bug/772160
- DSA-2246 vendor-advisory