Kris-Hoeppner

**Name of the Vulnerable Software and Affected Versions** Mahara versions 21.04 through 21.04.6 Mahara versions 21.10 through 21.10.4 Mahara versions 22.04 through 22.04.2 Mahara versions 22.10 through 22.09.9 is not a correct range, simplifying to: Mahara version 22.10.0 However, since 22.10.0 is the start of the range and there is no end version specified other than itself, and given that the context implies versions before a certain point are affected, the correct interpretation considering the context provided would be: Mahara versions 21.04 through 21.04.6 Mahara versions 21.10 through 21.10.4 Mahara versions 22.04 through 22.04.2 Mahara version 22.10.0 **Description** The issue allows embedded images to be accessible without a sufficient permission check under certain conditions. **Recommendations** For Mahara versions 21.04 through 21.04.6, update to version 21.04.7 or later. For Mahara versions 21.10 through 21.10.4, update to version 21.10.5 or later. For Mahara versions 22.04 through 22.04.2, update to version 22.04.3 or later. For Mahara version 22.10.0, update to a version later than 22.10.0.

**Name of the Vulnerable Software and Affected Versions** Mahara versions prior to 20.10.5 Mahara versions prior to 21.04.4 Mahara versions prior to 21.10.2 Mahara versions prior to 22.04.0 **Description** The issue allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action. **Recommendations** For versions prior to 20.10.5, update to version 20.10.5 or later. For versions prior to 21.04.4, update to version 21.04.4 or later. For versions prior to 21.10.2, update to version 21.10.2 or later. For versions prior to 22.04.0, update to version 22.04.0 or later.

**Name of the Vulnerable Software and Affected Versions** Mahara versions prior to 15.04.14 Mahara versions 16.x prior to 16.04.8 Mahara versions 16.10.x prior to 16.10.5 Mahara versions 17.x prior to 17.04.3 **Description** An issue allows unauthorized access to a user's account if the browser is closed without logging out of Mahara. The value in the `usr session` table remains, and an attacker can exploit this by adjusting the `mahara` cookie to the old value, thus gaining access to the user's account. **Recommendations** For Mahara versions prior to 15.04.14, update to version 15.04.14 or later. For Mahara versions 16.x prior to 16.04.8, update to version 16.04.8 or later. For Mahara versions 16.10.x prior to 16.10.5, update to version 16.10.5 or later. For Mahara versions 17.x prior to 17.04.3, update to version 17.04.3 or later.