VulnerabilityModified
CVE-2022-24694
In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders.
MEDIUM 4.3EPSS 0.76%
Does this matter?
Lower severity and a low EPSS score (0.76%). Track it; it rarely justifies an emergency change on its own.
Description
In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.)
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 0.76% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-552
- Affected
- mahara/mahara
- Source
- cve@mitre.org
References
- https://bugs.launchpad.net/mahara/+bug/1952808Exploit, Issue Tracking, Third Party Advisory
- https://mahara.org/interaction/forum/topic.php?id=8994Vendor Advisory
- https://bugs.launchpad.net/mahara/+bug/1952808Exploit, Issue Tracking, Third Party Advisory
- https://mahara.org/interaction/forum/topic.php?id=8994Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.