CVE-2021-29349

Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server

published March 31, 2021

CVSS
—
EPSS
2%
Percentile
74.8
In the wild
Unconfirmed
What it is

Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01545 · 74.8th percentile
Published
2021-03-31T22:31Z
EPSS history
Timeline
  • 31 MAR 22:31Z
    Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server
    cvelistv5