In Mahara prior to 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows malicious users to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
mahara mahara |