VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 31, 2021· Updated Jun 17, 2026

CVE-2021-29349

CVE-2021-29349

Description

Mahara 20.10 is affected by Cross Site Request Forgery (CSRF) that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieform_delete_all_notifications request, which leads to removing all messages from a mailbox.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Mahara (software)/Mahara2 versions
    cpe:2.3:a:mahara:mahara:20.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:mahara:mahara:20.10:*:*:*:*:*:*:*
    • (no CPE)range: 20.10
  • Mahara/Maharadescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.