Design/Logic Flaw

In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. Only folder names are affected. Neither file names nor file contents are affected...

CVE-2022-24694

CVE-2022-24694 affects Mahara: folder names in the Files area are visible to non-owners in Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1. Only folder names, not file names or contents, are exposed. Upgrading to the fixed versions (20.10.4, 21.04.3, 21.10.1) is the im...

CVE-2022-24694

In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. Only folder names are affected. Neither file names nor file contents are affected...

CVE-2022-24694

In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. Only folder names are affected. Neither file names nor file contents are affected...

Mahara 安全漏洞

Catalyst It Catalyst IT Mahara is a social networking system from Catalyst IT Catalyst It in New Zealand. The system includes a blog, resume builder, file manager, and more. A security vulnerability exists in Mahara, which stems from the fact that the name of a folder in the file area can be seen...

Mahara < 20.04.5, 20.10.x < 20.10.3, 21.4.x < 21.04.2 Multiple Vulnerabilities

Mahara is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mahara:mahara"; if description...

Mahara Cross-Site Scripting Vulnerability (CNVD-2021-103377)

Mahara is a social networking system owned by Catalyst IT in New Zealand. Mahara is vulnerable to cross-site scripting attacks via the \SCRIPT\ element...

Mahara Path Traversal Vulnerability

Mahara is a social networking system. The system includes a blog, resume builder, file manager, and more. Mahara suffers from a security vulnerability that allows an attacker to bypass the intended access control on HTML files through directory traversal...

CVE-2021-40848

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection...

CVE-2021-40849

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure at a minimum and often escalation of privileges...

CVE-2021-40848

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection...

CVE-2021-40849

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure at a minimum and often escalation of privileges...

Input validation

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection...

Information disclosure

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure at a minimum and often escalation of privileges...

CVE-2021-40849

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure at a minimum and often escalation of privileges...

CVE-2021-40848

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection...

CVE-2021-40849

CVE-2021-40849 affects Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0. The account tied to a web services token can be exploited to log in, causing information disclosure (at minimum) and often privilege escalation. Affected: Mahara versions listed above. Root cause and specific exploit det...

CVE-2021-40849

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure at a minimum and often escalation of privileges...

CVE-2021-40848

Summary: CVE-2021-40848 affects Mahara. Exports in Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0 may produce CSV files containing characters that a spreadsheet can interpret as commands, enabling execution of a malicious string locally on a device (CSV injection). Root cause: crafted conte...

CVE-2021-40848

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection...