CVE-2024-47853

An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning Tools Interoperability (LTI).

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://mahara.org/interaction/forum/topic.php?id=9594	Vendor Advisory
https://www.mahara.org	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mahara:mahara::::::::
	cpe:2.3:a:mahara:mahara::::::::

History

22 Sep 2025, 16:15

Type	Values Removed	Values Added
CWE		CWE-269

05 Sep 2025, 17:03

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
First Time		Mahara Mahara mahara
References	~~() https://mahara.org/interaction/forum/topic.php?id=9594 -~~	() https://mahara.org/interaction/forum/topic.php?id=9594 - Vendor Advisory
References	~~() https://www.mahara.org -~~	() https://www.mahara.org - Product
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:a:mahara:mahara::::::::

29 Aug 2025, 16:22

Type	Values Removed	Values Added
Summary		(es) Se detectó un problema en Mahara 23.04.8 y 24.04.4. Los atacantes podrían usar la escalada de privilegios en ciertos casos al iniciar sesión en Mahara con Learning Tools Interoperability (LTI).

26 Aug 2025, 14:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-08-26 14:15

Updated : 2025-09-22 16:15

NVD link : CVE-2024-47853

Mitre link : CVE-2024-47853

CVE.ORG link : CVE-2024-47853

JSON object : View

Products Affected

mahara

mahara

CWE

NVD-CWE-noinfo CWE-269

Improper Privilege Management

{"id": "CVE-2024-47853", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-08-26T14:15:35.037", "references": [{"url": "https://mahara.org/interaction/forum/topic.php?id=9594", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.mahara.org", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Mahara 23.04.8 and 24.04.4. Attackers may utilize escalation of privileges in certain cases when logging into Mahara with Learning Tools Interoperability (LTI)."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Mahara 23.04.8 y 24.04.4. Los atacantes podr\u00edan usar la escalada de privilegios en ciertos casos al iniciar sesi\u00f3n en Mahara con Learning Tools Interoperability (LTI)."}], "lastModified": "2025-09-22T16:15:38.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "402D24E6-C713-4FCA-B087-25EE7D35A147", "versionEndExcluding": "23.04.9"}, {"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE3AA4BB-0073-44DC-8E37-D62399B750A9", "versionEndExcluding": "24.04.5", "versionStartIncluding": "24.04.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}