CVE-2022-24111

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-10 · updated 2026-06-17
Weakness: CWE-306

Description

In Mahara 21.04 before 21.04.3 and 21.10 before 21.10.1, portfolios created in groups that have not been shared with non-group members and portfolios created on the site and institution levels can be viewed without requiring a login if the URL to these portfolios is known.

Affected products

mahara: from 21.04.0 before 21.04.3; 21.10.0 — fixed in 21.04.3

How to fix

Upgrade to a fixed version: mahara 21.04.3. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/mahara/+bug/1959146
https://mahara.org/interaction/forum/topic.php?id=8996
https://bugs.launchpad.net/mahara/+bug/1959146
https://mahara.org/interaction/forum/topic.php?id=8996

Get alerted when CVE-2022-24111 or the next vulnerability affects your stack