CVE-2020-9387 - In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on

Back Back to CVE browser

MEDIUM

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on

Published Apr 30, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.72%

Description

In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

https://bugs.launchpad.net/mahara/+bug/1836984
x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30208
Advisory
https://mahara.org/interaction/forum/topic.php?id=8612
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://bugs.launchpad.net/mahara/+bug/1836984		x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30208		Advisory
https://mahara.org/interaction/forum/topic.php?id=8612		x_refsource_CONFIRMVendor Advisory