CVE-2020-9386

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-09 · updated 2026-06-17
Weakness: CWE-200

Description

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore.

Affected products

mahara: from 18.10.0 before 18.10.5; from 19.04.0 before 19.04.4; from 19.10.0 before 19.10.2 — fixed in 18.10.5, 19.04.4, 19.10.2

How to fix

Upgrade to a fixed version: mahara 18.10.5, 19.04.4, 19.10.2. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/mahara/+bug/1840201
https://mahara.org/interaction/forum/topic.php?id=8589
https://bugs.launchpad.net/mahara/+bug/1840201
https://mahara.org/interaction/forum/topic.php?id=8589

Get alerted when CVE-2020-9386 or the next vulnerability affects your stack