Robert Lyon

The issue is related to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessable.

The names of folders in the Files area can be seen by a person not owning the folders. Only folder names are affected, neither file names nor file contents are exposed.

The account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure and often escalation of privileges.

The issue concerns the sharing of account details in Elasticsearch results for accounts that are not accessible. This occurs when the config setting 'Isolated institutions' is turned on.

The issue allows certain personal information to be discoverable by inspecting network responses on the 'Edit access' screen when sharing portfolios.

The issue concerns the disclosure of file metadata information to group members in the Elasticsearch result list, despite them not having access to the artefact anymore. This occurs due to a problem where access controls are not properly enforced, leading to unauthorized disclosure of information.

An issue was discovered that allows a site administrator to suspend the system user, causing all users to be locked out from the system.

The issue allows plain text passwords to be recorded in the event log table during the user creation process if full event logging was turned on.

The issue affects authentication methods that do not utilize Mahara's built-in login form, allowing users to log in even if their institution has been expired or suspended.

The issue allows logged-in users to remain logged in even after the institution they belong to has been suspended.

The issue allows group members to lose access to the group files they uploaded if another group member changes the access permissions on them.

The issue allows profile pictures to be accessed without any access control checks, consequently allowing any of a user's uploaded profile pictures to be viewable by anyone, whether or not they were currently selected as the "default" or used in any pages.

The issue allows a user to submit potentially dangerous payloads, such as XSS code, to be saved as their first name, last name, or display name in the profile fields. This can cause issues including escalation of privileges or unknown execution of malicious code when replying to messages in Mahara.

An issue allows unauthorized access to a user's account if the browser is closed without logging out of Mahara. The value in the `usr session` table remains, and an attacker can exploit this by adjusting the `mahara` cookie to the old value, thus gaining access to the user's account.