Vulnerability-Lookup

CNVD-2018-11231

Vulnerability from cnvd - Published: 2018-06-12

Title

Catalyst Mahara信息泄露漏洞（CNVD-2018-11231）

Description

Catalyst Mahara是新西兰Catalyst IT公司的一套社交网络系统。该系统包含博客、履历表生成器、文件管理器等。 Catalyst Mahara 17.04.8之前的17.04版本、17.10.5之前的17.10版本和18.04.1之前的18.04版本中存在安全漏洞，该漏洞源于用户在注册已存在的用户名时，程序返回的错误信息为‘对不起，该用户名已经存在’。攻击者可利用该漏洞获取信息。

Severity

中

Patch Name

Catalyst Mahara信息泄露漏洞（CNVD-2018-11231）的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://mahara.org/

Reference

https://bugs.launchpad.net/mahara/+bug/1772774

Impacted products

Name
['Catalyst IT Mahara 17.04，<17.04.8', 'Catalyst IT Mahara 17.10，<17.10.5', 'Catalyst IT Mahara 18.04，<18.04.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-11565"
    }
  },
  "description": "Catalyst Mahara\u662f\u65b0\u897f\u5170Catalyst IT\u516c\u53f8\u7684\u4e00\u5957\u793e\u4ea4\u7f51\u7edc\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u5305\u542b\u535a\u5ba2\u3001\u5c65\u5386\u8868\u751f\u6210\u5668\u3001\u6587\u4ef6\u7ba1\u7406\u5668\u7b49\u3002\r\n\r\nCatalyst Mahara 17.04.8\u4e4b\u524d\u768417.04\u7248\u672c\u300117.10.5\u4e4b\u524d\u768417.10\u7248\u672c\u548c18.04.1\u4e4b\u524d\u768418.04\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7528\u6237\u5728\u6ce8\u518c\u5df2\u5b58\u5728\u7684\u7528\u6237\u540d\u65f6\uff0c\u7a0b\u5e8f\u8fd4\u56de\u7684\u9519\u8bef\u4fe1\u606f\u4e3a\u2018\u5bf9\u4e0d\u8d77\uff0c\u8be5\u7528\u6237\u540d\u5df2\u7ecf\u5b58\u5728\u2019\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u4fe1\u606f\u3002",
  "discovererName": "Unknow",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://mahara.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-11231",
  "openTime": "2018-06-12",
  "patchDescription": "Catalyst Mahara\u662f\u65b0\u897f\u5170Catalyst IT\u516c\u53f8\u7684\u4e00\u5957\u793e\u4ea4\u7f51\u7edc\u7cfb\u7edf\u3002\u8be5\u7cfb\u7edf\u5305\u542b\u535a\u5ba2\u3001\u5c65\u5386\u8868\u751f\u6210\u5668\u3001\u6587\u4ef6\u7ba1\u7406\u5668\u7b49\u3002\r\n\r\nCatalyst Mahara 17.04.8\u4e4b\u524d\u768417.04\u7248\u672c\u300117.10.5\u4e4b\u524d\u768417.10\u7248\u672c\u548c18.04.1\u4e4b\u524d\u768418.04\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7528\u6237\u5728\u6ce8\u518c\u5df2\u5b58\u5728\u7684\u7528\u6237\u540d\u65f6\uff0c\u7a0b\u5e8f\u8fd4\u56de\u7684\u9519\u8bef\u4fe1\u606f\u4e3a\u2018\u5bf9\u4e0d\u8d77\uff0c\u8be5\u7528\u6237\u540d\u5df2\u7ecf\u5b58\u5728\u2019\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Catalyst Mahara\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2018-11231\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Catalyst IT Mahara 17.04\uff0c\u003c17.04.8",
      "Catalyst IT Mahara 17.10\uff0c\u003c17.10.5",
      "Catalyst IT Mahara 18.04\uff0c\u003c18.04.1"
    ]
  },
  "referenceLink": "https://bugs.launchpad.net/mahara/+bug/1772774",
  "serverity": "\u4e2d",
  "submitTime": "2018-06-01",
  "title": "Catalyst Mahara\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2018-11231\uff09"
}

CVE-2018-11565 (GCVE-0-2018-11565)

Vulnerability from cvelistv5 – Published: 2018-05-30 21:00 – Updated: 2024-08-05 08:10

Summary

Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

2 references

URL	Tags
https://mahara.org/interaction/forum/topic.php?id=8271	x_refsource_CONFIRM
https://bugs.launchpad.net/mahara/+bug/1772774	x_refsource_CONFIRM

Date Public

2018-05-30 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:10:14.659Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://mahara.org/interaction/forum/topic.php?id=8271"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.launchpad.net/mahara/+bug/1772774"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-05-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-05-31T16:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://mahara.org/interaction/forum/topic.php?id=8271"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.launchpad.net/mahara/+bug/1772774"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-11565",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Mahara 17.04 before 17.04.8 and 17.10 before 17.10.5 and 18.04 before 18.04.1 are vulnerable to mentioning the usernames that are already taken by people registered in the system rather than masking that information."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://mahara.org/interaction/forum/topic.php?id=8271",
              "refsource": "CONFIRM",
              "url": "https://mahara.org/interaction/forum/topic.php?id=8271"
            },
            {
              "name": "https://bugs.launchpad.net/mahara/+bug/1772774",
              "refsource": "CONFIRM",
              "url": "https://bugs.launchpad.net/mahara/+bug/1772774"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-11565",
    "datePublished": "2018-05-30T21:00:00.000Z",
    "dateReserved": "2018-05-30T00:00:00.000Z",
    "dateUpdated": "2024-08-05T08:10:14.659Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2018-11231

CVE-2018-11565 (GCVE-0-2018-11565)

Tags

Sightings

Nomenclature