4.3

CVE-2022-24694

Exploit

In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.)

Data is provided by the National Vulnerability Database (NVD)
Mahara ≫ Mahara Version >= 20.10.0 < 20.10.4
Mahara ≫ Mahara Version >= 21.04.0 < 21.04.3
Mahara ≫ Mahara Version21.10.0 Update-
Mahara ≫ Mahara Version21.10.0 Updaterc1
Mahara ≫ Mahara Version21.10.0 Updaterc2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.19% 0.377
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-552 Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

https://bugs.launchpad.net/mahara/+bug/1952808
Third Party Advisory
Exploit
Issue Tracking