Mahara: >> Mahara >> 24.04.2 Security Vulnerabilities
An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have permission to download.
CVSS Score
5.3
EPSS Score
0.0
Published
2025-08-26
Mahara before 24.04.9 exposes database connection information if the database becomes unreachable, e.g., due to the database server being temporarily down or too busy.
CVSS Score
7.5
EPSS Score
0.0
Published
2025-08-26
An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning Tools Interoperability (LTI).
CVSS Score
8.8
EPSS Score
0.001
Published
2025-08-26
In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute.
CVSS Score
6.1
EPSS Score
0.0
Published
2025-08-26
An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. The About, Contact, and Help footer links can be set up to be vulnerable to Cross Site Scripting (XSS) due to not sanitising the values. These links can only be set up by an admin but are clickable by any logged-in person.
CVSS Score
6.1
EPSS Score
0.0
Published
2025-08-25