CVE-2011-1406: Mahara

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

Mahara before 1.3.6 does not properly handle an https URL in the wwwroot configuration setting, which makes it easier for user-assisted remote attackers to obtain credentials by sniffing the network at a time when an http URL is used for a login.

Affected products

• Mahara Mahara: up to and including 1.3.5; version 0.9.0 only; version 0.9.1 only; version 0.9.2 only; version 1.0.0 only; version 1.0.1 only; …

Published 2011-05-13. Last modified 2026-06-16.