Richard Mansfield

**Name of the Vulnerable Software and Affected Versions** Mahara versions prior to 1.4.1 **Description** The issue concerns the `get dataroot image path` function in `lib/file.php`, which does not properly validate uploaded image files. This allows remote attackers to cause a denial of service, specifically memory consumption, by uploading either large or invalid images. **Recommendations** For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the upload of image files to prevent potential denial of service attacks.

**Name of the Vulnerable Software and Affected Versions** Mahara versions prior to 1.4.1 **Description** A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution. **Recommendations** For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Mahara versions prior to 1.3.6 **Description** The issue allows remote authenticated users to bypass intended access restrictions. This can lead to various unauthorized actions such as suspending a user account, editing or visiting a view, editing a plan artefact, reading plans or blog blocks and artefacts, or accessing a block. The actions can be performed via requests associated with several API endpoints, including "admin/users/search.json.php", "view/newviewtoken.json.php", "lib/mahara.php", "artefact/plans/tasks.json.php", "artefact/plans/viewtasks.json.php", "artefact/blog/view/index.json.php", "artefact/blog/posts.json.php", and "blocktype/myfriends/myfriends.json.php". The problem is related to incorrect privilege enforcement, a missing `user id` check, and incorrect enforcement of the Overriding Start/Stop Dates setting. **Recommendations** For Mahara versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints until the update can be applied. Additionally, review and restrict user privileges to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mahara versions prior to 1.3.6 **Description** The issue allows remote authenticated users to obtain sensitive information via certain requests. This is due to the improper restriction of data in responses to AJAX calls. The affected API endpoints include "blocktype/myfriends/myfriends.json.php", "json/usersearch.php", "group/membersearchresults.json.php", and "json/friendsearch.php". This can lead to the exposure of information about friends and e-mail addresses. **Recommendations** For Mahara versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mahara versions prior to 1.3.6 **Description** The issue is related to a cross-site scripting (XSS) vulnerability that allows remote authenticated users to inject arbitrary web script or HTML. This is achieved via vectors associated with HTML e-mail messages and is related to files artefact/comment/lib.php and interaction/forum/lib.php. **Recommendations** For versions prior to 1.3.6, update to version 1.3.6 or later to resolve the issue. As a temporary workaround, consider restricting the use of HTML in e-mail messages to minimize the risk of exploitation.