Information disclosure

2020-03-0916:15:00

PRIOn knowledge base

www.prio-n.com

4.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore.

CPENameOperatorVersion
maharage18.10.0
maharalt18.10.5
maharage19.04.0
maharalt19.04.4
maharage19.10.0
maharalt19.10.2

Name	Operator	Version
mahara	ge	18.10.0
mahara	lt	18.10.5
mahara	ge	19.04.0
mahara	lt	19.04.4
mahara	ge	19.10.0
mahara	lt	19.10.2

References

bugs.launchpad.net/mahara/+bug/1840201

mahara.org/interaction/forum/topic.php?id=8589