CVE-2010-1670

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-07-06 · updated 2026-06-16
Weakness: CWE-287

Description

Mahara before 1.0.15, 1.1.x before 1.1.9, and 1.2.x before 1.2.5 has improper configuration options for authentication plugins associated with logins that use the single sign-on (SSO) functionality, which allows remote attackers to bypass authentication via an empty password. NOTE: some of these details are obtained from third party information.

Affected products

mahara: through 1.0.14; 0.9.0, 0.9.1, 0.9.2, 1.0.0, 1.0.1, 1.0.2 (+41)

References

http://secunia.com/advisories/40431
http://wiki.mahara.org/Release_Notes/1.0.15
http://wiki.mahara.org/Release_Notes/1.1.9
http://wiki.mahara.org/Release_Notes/1.2.5
http://www.securityfocus.com/bid/41319
http://secunia.com/advisories/40431
http://wiki.mahara.org/Release_Notes/1.0.15
http://wiki.mahara.org/Release_Notes/1.1.9
http://wiki.mahara.org/Release_Notes/1.2.5
http://www.securityfocus.com/bid/41319

Get alerted when CVE-2010-1670 or the next vulnerability affects your stack