Mahara Information Disclosure Vulnerability in Database Connection Details

An information disclosure vulnerability has been identified in Mahara versions prior to 24.04.9. This issue arises when the database becomes unreachable, such as during temporary downtime or high traffic. In such cases, sensitive database connection information, including the database host's IP address, database name, and database username, may be exposed.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive database connection information.

Remediation

Users are advised to update to Mahara version 24.04.9 or later. The update is available via the Mahara Git repository or as a downloadable package from the Mahara releases page. Instructions for updating Mahara can be found in the Mahara manual.