PT-2022-16472 · Mahara · Mahara

Doris ⚡ + 1 · Published 2022-02-10 · Updated 2022-02-23 · CVE-2022-24111

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mahara versions 21.04 through 21.04.2 Mahara versions 21.10 through 21.10.0

Description The issue allows portfolios created in groups that have not been shared with non-group members and portfolios created on the site and institution levels to be viewed without requiring a login if the URL to these portfolios is known.

Recommendations For Mahara versions 21.04 through 21.04.2, update to version 21.04.3 to resolve the issue. For Mahara versions 21.10 through 21.10.0, update to version 21.10.1 to resolve the issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2022-24111

Affected Products

Mahara

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-24111 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24111 · Vendor Advisory
• https://mahara.org/interaction/forum/topic.php?id=8996 · Vendor Advisory
• https://t.me/cibsecurity/37225 · Telegram Post
• https://t.me/cvenotify/27218 · Telegram Post
• https://bugs.launchpad.net/mahara/+bug/1959146 · Note