CVE-2020-9387

{"id": "CVE-2020-9387", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2020-04-30T13:15:13.460", "references": [{"url": "https://bugs.launchpad.net/mahara/+bug/1836984", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://mahara.org/interaction/forum/topic.php?id=8612", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://bugs.launchpad.net/mahara/+bug/1836984", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://mahara.org/interaction/forum/topic.php?id=8612", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "In Mahara 19.04 before 19.04.5 and 19.10 before 19.10.3, account details are shared in the Elasticsearch results for accounts that are not accessible when the config setting 'Isolated institutions' is turned on."}, {"lang": "es", "value": "En Mahara versiones 19.04 anteriores a la versi\u00f3n 19.04.5 y versiones 19.10 anteriores a la versi\u00f3n 19.10.3, los detalles de cuentas son compartidos en los resultados de Elasticsearch para las cuentas que no son accesibles cuando el ajuste de configuraci\u00f3n \"Isolated institutions\" est\u00e1 activado."}], "lastModified": "2024-11-21T05:40:32.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03829FC2-5003-4325-B0A9-56AF4B75EAED", "versionEndExcluding": "19.04.5", "versionStartIncluding": "19.04"}, {"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B87F6ACC-C0AB-469A-92DA-886207E63800", "versionEndExcluding": "19.10.3", "versionStartIncluding": "19.10"}, {"criteria": "cpe:2.3:a:mahara:mahara:20.04:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "422F667D-A371-4615-AA29-EAA80185386E"}, {"criteria": "cpe:2.3:a:mahara:mahara:20.04:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2EAEBCCF-6E76-4B15-BFFA-0119DEFE56D3"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}