CVE-2022-33913

In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check.

• CWE-862

• https://mahara.org/interaction/forum/topic.php?id=9138Exploit, Issue Tracking, Third Party Advisory, Vendor Advisory
• https://mahara.org/interaction/forum/topic.php?id=9138Exploit, Issue Tracking, Third Party Advisory, Vendor Advisory

Published

Jun 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-33908DMA transactions which are targeted at input buffers used fo…7
• CVE-2022-33909DMA transactions which are targeted at input buffers used fo…7
• CVE-2022-3391The Retain Live Chat WordPress plugin through 0.1 does not s…4.8
• CVE-2022-33910An XSS vulnerability in MantisBT before 2.25.5 allows remote…5.4
• CVE-2022-33911An issue was discovered in Couchbase Server 7.x before 7.0.4…5.3
• CVE-2022-33912A permission issue affects users that deployed the shipped v…7.8
• CVE-2022-33915Versions of the Amazon AWS Apache Log4j hotpatch package bef…7
• CVE-2022-33916OPC UA .NET Standard Reference Server 1.04.368 allows a remo…7.5
• CVE-2022-33917An issue was discovered in the Arm Mali GPU Kernel Driver (V…5.5
• CVE-2022-33918Dell GeoDrive, Versions 2.1 - 2.2, contains an information d…5.5
• CVE-2022-33919Dell GeoDrive, versions 2.1 - 2.2, contains an information d…7.8
• CVE-2022-3392The WP Humans.txt WordPress plugin through 1.0.6 does not sa…4.8