CVE-2021-29349

    Dashboard / Vulnerabilities / CVE-2021-29349

    CVE-2021-29349

    Published: 31 Mar 2021Last Modified: 8 Jul 2026

    Summary:

    Details: Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox.

    References: https://github.com/0xBaz/CVE-2021-29349/issues/1

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- baa466e351a72541cd7a28d6eb982a1fbc7a428c
    Fixed -None

    Affected versions

    20.10
    20.10.0_RELEASE

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-29349 | CVE-DB