CVE-2022-24694

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-09 · updated 2026-06-17
Weakness: CWE-552

Description

In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.)

Affected products

mahara: from 20.10.0 before 20.10.4; from 21.04.0 before 21.04.3; 21.10.0, 21.10.0-rc1, 21.10.0-rc2 — fixed in 20.10.4, 21.04.3

How to fix

Upgrade to a fixed version: mahara 20.10.4, 21.04.3. Check the vendor advisory for mitigations.

References

https://bugs.launchpad.net/mahara/+bug/1952808
https://mahara.org/interaction/forum/topic.php?id=8994
https://bugs.launchpad.net/mahara/+bug/1952808
https://mahara.org/interaction/forum/topic.php?id=8994

Get alerted when CVE-2022-24694 or the next vulnerability affects your stack