Vulnerabilities > Mahara

DATE CVE VULNERABILITY TITLE RISK
2022-06-20 CVE-2022-33913 Incorrect Authorization vulnerability in Mahara
In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check.
network
mahara CWE-863
4.3
2022-04-28 CVE-2022-28892 Cross-Site Request Forgery (CSRF) vulnerability in Mahara
Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessable.
network
mahara CWE-352
6.8
2022-04-28 CVE-2022-29584 Cross-site Scripting vulnerability in Mahara
Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action.
network
mahara CWE-79
3.5
2022-04-28 CVE-2022-29585 Incorrect Default Permissions vulnerability in Mahara
In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used.
network
low complexity
mahara CWE-276
5.0
2022-02-10 CVE-2022-24111 Missing Authentication for Critical Function vulnerability in Mahara
In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and portfolios created on the site and institution levels can be viewed without requiring a login if the URL to these portfolios is known.
network
low complexity
mahara CWE-306
5.0
2022-02-09 CVE-2022-24694 Files or Directories Accessible to External Parties vulnerability in Mahara
In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders.
network
low complexity
mahara CWE-552
4.0
2021-11-03 CVE-2021-40848 Improper Neutralization of Formula Elements in a CSV File vulnerability in Mahara
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection.
network
mahara CWE-1236
6.8
2021-11-03 CVE-2021-40849 Insufficient Session Expiration vulnerability in Mahara
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.
network
low complexity
mahara CWE-613
7.5
2021-11-02 CVE-2021-43264 Path Traversal vulnerability in Mahara
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal.
local
low complexity
mahara CWE-22
2.1
2021-11-02 CVE-2021-43265 Cross-site Scripting vulnerability in Mahara
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, certain tag syntax could be used for XSS, such as via a SCRIPT element.
network
mahara CWE-79
3.5