Mahara Information Disclosure Vulnerability in HTML Bulk Export

A vulnerability allowing information disclosure exists in Mahara versions prior to 22.10.4 and 23.x prior to 23.04.4. This issue arises when the experimental HTML bulk export feature is used through the administration interface or the command line interface (CLI). The exported files may contain images of other account holders, as the cache is not cleared after exporting files for one account.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure, allowing account holders to access images of other users.

Remediation

Users are advised to update Mahara to the latest minor point release of their current version series. For those on unsupported versions, upgrading to a supported version is recommended. Extended security support is available for purchase as an add-on.