Total vulnerabilities in the database
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.
| Software | From | Fixed in |
|---|---|---|
| mahara / mahara | 21.10.0-rc2 | 21.10.0-rc2.x |
| mahara / mahara | 21.10.0-rc1 | 21.10.0-rc1.x |
| mahara / mahara | 21.04.0 | 21.04.2 |
| mahara / mahara | 20.10.0 | 20.10.3 |
| mahara / mahara | - | 20.04.5 |