CVE-2022-29585

Published: Apr 28, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown from page 2 of the group results list (rather than only being shown for the institution that the viewer is a member of).

Affected (4)

Products: Mahara: Mahara

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Before 20.10.5
Mahara Mahara	From 21.04.0 to 21.04.4
Mahara Mahara	From 21.10.0 to 21.10.2
Mahara Mahara	Version 22.04.0 rc1

Related CWEs

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

References (4)

https://bugs.launchpad.net/mahara/+bug/1922226

Source: cve@mitre.org

Vendor Advisory

https://mahara.org/interaction/forum/topic.php?id=9093

Source: cve@mitre.org

Vendor Advisory

https://bugs.launchpad.net/mahara/+bug/1922226

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://mahara.org/interaction/forum/topic.php?id=9093

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.