Design/Logic Flaw

In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. Only folder names are affected. Neither file names nor file contents are affected...

CVE-2021-29349

Mahara 20.10 is affected by Cross Site Request Forgery CSRF that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieformdeleteallnotifications...

CVE-2021-29349

Mahara 20.10 is affected by Cross Site Request Forgery CSRF that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieformdeleteallnotifications...

Cross site request forgery (csrf)

Mahara 20.10 is affected by Cross Site Request Forgery CSRF that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieformdeleteallnotifications...

CVE-2021-29349

Mahara 20.10 is affected by Cross Site Request Forgery CSRF that allows a remote attacker to remove inbox-mail on the server. The application fails to validate the CSRF token for a POST request. An attacker can craft a module/multirecipientnotification/inbox.php pieformdeleteallnotifications...