CVEvulnerability

CVE-2021-43264

3.3 LOW Published 2021-11-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-11-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-22

Description

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character.

Affected configurations

• mahara mahara (>= 20.04.0 < 20.04.5) • mahara mahara (>= 20.10.0 < 20.10.3) • mahara mahara (>= 21.04.0 < 21.04.2)

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References