CVE-2020-9387: Infoleak
First published: Thu Apr 30 2020(Updated: )
In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mahara Mahara | >=19.04<19.04.5 | |
| Mahara Mahara | >=19.10<19.10.3 | |
| Mahara Mahara | =20.04-rc1 | |
| Mahara Mahara | =20.04-rc2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-9387?
CVE-2020-9387 is a vulnerability that exists in Mahara versions 19.04 before 19.04.5 and 19.10 before 19.10.3.
How does CVE-2020-9387 affect Mahara?
CVE-2020-9387 allows account details to be shared in the Elasticsearch results for inaccessible accounts when the 'Isolated institutions' config setting is turned on.
What is the severity of CVE-2020-9387?
The severity of CVE-2020-9387 is medium with a CVSS score of 4.3.
How can I fix CVE-2020-9387?
To fix CVE-2020-9387, upgrade to Mahara versions 19.04.5 or 19.10.3 or later.
Where can I find more information about CVE-2020-9387?
More information about CVE-2020-9387 can be found at the following references: [1] [2].
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/event
- agent/tags
- agent/first-publish-date
- agent/description
- vendor/mahara
- canonical/mahara mahara
- version/mahara mahara/19.04
- version/mahara mahara/19.10
- version/mahara mahara/20.04-rc1
- version/mahara mahara/20.04-rc2