GCVE - cpe:2.3:a:mahara:mahara:21.10.0:rc1:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mahara:mahara:21.10.0:rc1:*:*:*:*:*:*

part: a version: 21.10.0 update: rc1

Vendor	Mahara (`07d8f057-c7ff-5103-941c-641bef17cee0`)
Product	Mahara (`e34a4551-28da-5ed2-b032-aa35dad26cc2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/maharaproject/mahara`	purl2cpe	2026-06-01 10:17:27.261101
`pkg:mahara/mahara/mahara`	purl2cpe	2026-06-01 10:17:27.261102

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-24694`	vulnerable	2026-06-08 05:41:01.389645	Details available In Mahara 20.10 before 20.10.4, 21.04 before 21.04.3, and 21.10 before 21.10.1, the names of folders in the Files area can be seen by a person not owning the folders. (Only folder names are affected. Neither file names nor file contents are affected.) Published: 2022-02-09T04:31:50.000Z Updated: 2024-08-03T04:20:50.285Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/1952808 https://mahara.org/interaction/forum/topic.php?id=8994	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40849`	vulnerable	2026-06-08 05:35:19.170511	Details available In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges. Published: 2021-11-03T10:14:53.000Z Updated: 2024-08-04T02:51:07.447Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/1930469 https://mahara.org/interaction/forum/topic.php?id=8949	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-40848`	vulnerable	2026-06-08 05:35:19.169280	Details available In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exported CSV files could contain characters that a spreadsheet program could interpret as a command, leading to execution of a malicious string locally on a device, aka CSV injection. Published: 2021-11-03T10:11:45.000Z Updated: 2024-08-04T02:51:07.439Z Open on db.gcve.eu Reference links https://bugs.launchpad.net/mahara/+bug/1930471 https://mahara.org/interaction/forum/topic.php?id=8950	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.