LiveActive security incident?Get immediate response
CVE Record

CVE-2011-4118: Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users...

Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takemoderate

Analyst readout for executives and security teams

Plain-English summary

This is an old Mahara privilege-escalation issue. Mahara versions before 1.4.1 could let a remote authenticated user gain extra privileges when the MNet, or Moodle network, feature was in use. Exposure is mainly legacy Mahara deployments that still use MNet integration.

Executive priority

Prioritize remediation if Mahara is still used with Moodle network integration. This is not a broad internet-wide emergency from the provided evidence, but legacy education platforms can hold sensitive user data and privilege escalation should be closed quickly.

Technical view

CVE-2011-4118 affects Mahara before 1.4.1 when MNet is used. The published description says authenticated remote users could gain privileges through a jump to an XMLRPC target. The bundle provides no CVSS, CWE, exploit details, or KEV evidence.

Likely exposure

Likely exposure is limited to organizations running Mahara before 1.4.1 with MNet enabled. Systems not running Mahara, running 1.4.1 or later, or not using MNet are less likely to be affected based on the source description.

Exploitation context

The sources support remote authenticated privilege gain, not unauthenticated compromise. KEV is false and the bundle contains no evidence of active exploitation. The exact privilege boundary, affected roles, and practical exploitability are not fully described in the provided sources.

Researcher notes

Focus validation on Mahara versions before 1.4.1 and MNet-enabled XMLRPC flows. The public bundle is sparse: no CVSS, CWE, detailed affected package matrix, or exploit confirmation is provided. Avoid assuming impact beyond authenticated privilege escalation.

Mitigation direction

  • Identify any Mahara deployments and their exact versions.
  • Upgrade Mahara to 1.4.1 or a vendor-supported fixed package.
  • For Debian-managed systems, review Debian DSA-2334 package guidance.
  • Review whether MNet is enabled and still required.
  • Check Mahara or distribution guidance before changing production configuration.

Validation and detection

  • Confirm whether Mahara is present in asset inventory.
  • Verify Mahara version is 1.4.1 or later.
  • Check application configuration for MNet or Moodle network use.
  • Review authentication logs for unexpected privilege changes around MNet workflows.
  • Document systems that remain on unsupported legacy Mahara versions.
Prepared
Confidence
medium
Sources
7

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2011-4118 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.