CVE-2023-47799 - Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders

Back Back to CVE browser

HIGH

Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders

Published Aug 25, 2025

7.5

HIGH

CVSS 3.1

EPSS 0.41%

Description

Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administration interface or via the CLI, and the resulting export files are given to the account holders. They may contain images of other account holders because the cache is not cleared after the files of one account are exported.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-51894
Advisory
https://git.mahara.org/catalyst-security/mahara-security/-/issues/2
Broken Link
https://mahara.org/interaction/forum/topic.php?id=9353
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-51894		Advisory
https://git.mahara.org/catalyst-security/mahara-security/-/issues/2		Broken Link
https://mahara.org/interaction/forum/topic.php?id=9353		Vendor Advisory