PT-2022-19708 · Mahara · Mahara

Andreas Schenkel + 1 · Published 2022-04-28 · Updated 2022-05-09 · CVE-2022-29585

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 20.10.5 Mahara versions prior to 21.04.4 Mahara versions prior to 21.10.2 Mahara versions prior to 22.04.0

Description The issue affects sites using Isolated Institutions when more than ten groups are used. In such cases, all groups are shown from page 2 of the group results list, rather than only being shown for the institution that the viewer is a member of.

Recommendations For versions prior to 20.10.5, update to version 20.10.5 or later. For versions prior to 21.04.4, update to version 21.04.4 or later. For versions prior to 21.10.2, update to version 21.10.2 or later. For versions prior to 22.04.0, update to version 22.04.0 or later.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-29585

Affected Products

Mahara

References · 5

• https://mahara.org/interaction/forum/topic.php?id=9093 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29585 · Security Note
• https://bugs.launchpad.net/mahara/+bug/1922226 · Vendor Advisory
• https://t.me/cibsecurity/41598 · Telegram Post