CVE-2020-9386

—

CVSS 3.1

4.3 medium

EPSS

1%p61

Published

Mar 9, 2020 (Mar 9, 2020)

Modified

Jun 17, 2026

Description

In Mahara 18.10 before 18.10.5, 19.04 before 19.04.4, and 19.10 before 19.10.2, file metadata information is disclosed to group members in the Elasticsearch result list despite them not having access to that artefact anymore.

Vendors: mahara
Products: mahara
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.0%)

In the news0 stories

No ingested article mentions this CVE yet.