PT-2020-20628
CVE-2020-9387
·
Published
2020-04-30
·
Updated
2020-05-12
Description by
CVSS 3.1
4.3
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Mahara versions 19.04 through 19.04.4
Mahara versions 19.10 through 19.10.2
Description
The issue concerns the sharing of account details in Elasticsearch results for accounts that are not accessible. This occurs when the config setting 'Isolated institutions' is turned on.
Recommendations
For Mahara versions 19.04 through 19.04.4, update to version 19.04.5 to resolve the issue.
For Mahara versions 19.10 through 19.10.2, update to version 19.10.3 to resolve the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾