CVE-2022-24694

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.)

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugs.launchpad.net/mahara/+bug/1952808Exploit, Issue Tracking, Third Party Advisory
https://mahara.org/interaction/forum/topic.php?id=8994Vendor Advisory
https://bugs.launchpad.net/mahara/+bug/1952808Exploit, Issue Tracking, Third Party Advisory
https://mahara.org/interaction/forum/topic.php?id=8994Vendor Advisory

Timeline

Published: Feb 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-246954.3Bluetooth Classic in Bluetooth Core Specification through 5.3 does not properly conceal device information for Bluetooth transceivers in Non CVE-2022-246967.8Mirametrix Glance before 5.1.1.42207 (released on 2018-08-30) allows a local attacker to elevate privileges. NOTE: this is unrelated to prod CVE-2022-246979.8Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu CVE-2022-24706.1Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21.CVE-2022-247007.5An issue was discovered in WinAPRS 2.9.0. A buffer overflow in DIGI address processing for VHF KISS packets allows a remote attacker to caus CVE-2022-247017.8An issue was discovered in WinAPRS 2.9.0. A buffer overflow in national.txt processing allows a local attacker to cause a denial of service CVE-2022-247029.8An issue was discovered in WinAPRS 2.9.0. A buffer overflow in the VHF KISS TNC component allows a remote attacker to achieve remote code ex CVE-2022-247049.8The rad_packet_recv function in opt/src/accel-pppd/radius/packet.c suffers from a buffer overflow vulnerability, whereby user input len is c CVE-2022-247059.8The rad_packet_recv function in radius/packet.c suffers from a memcpy buffer overflow, resulting in an overly-large recvfrom into a fixed bu CVE-2022-247069.8In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin pr CVE-2022-247078.8Anuko Time Tracker is an open source, web-based time tracking application written in PHP. UNION SQL injection and time-based blind injection CVE-2022-247085.4Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to