CVE-2021-43264

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2021-11-08T11:03:50.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugs.launchpad.net/mahara/+bug/1944979"}, {"tags": ["x_refsource_MISC"], "url": "https://mahara.org/interaction/forum/topic.php?id=8954"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2021-43264", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugs.launchpad.net/mahara/+bug/1944979", "refsource": "MISC", "url": "https://bugs.launchpad.net/mahara/+bug/1944979"}, {"name": "https://mahara.org/interaction/forum/topic.php?id=8954", "refsource": "MISC", "url": "https://mahara.org/interaction/forum/topic.php?id=8954"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T03:55:28.151Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.launchpad.net/mahara/+bug/1944979"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://mahara.org/interaction/forum/topic.php?id=8954"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2021-43264", "datePublished": "2021-11-02T21:55:22.000Z", "dateReserved": "2021-11-02T00:00:00.000Z", "dateUpdated": "2024-08-04T03:55:28.151Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1DDE4C7-FE22-41A8-AB98-F410A470268E", "versionEndExcluding": "20.04.5", "versionStartIncluding": "20.04.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "matchCriteriaId": "54ED5D80-651C-4B0E-81AC-DB23BF6DFCF9", "versionEndExcluding": "20.10.3", "versionStartIncluding": "20.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*", "matchCriteriaId": "5DEE88DE-CD36-4F04-AB37-D155FABD12B8", "versionEndExcluding": "21.04.2", "versionStartIncluding": "21.04.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, adjusting the path component for the page help file allows attackers to bypass the intended access control for HTML files via directory traversal. It replaces the - character with the / character."}, {"lang": "es", "value": "En Mahara versiones anteriores a 20.04.5, 20.10.3, 21.04.2 y 21.10.0, el ajuste del componente de la ruta para el archivo de ayuda de la p\u00e1gina permite a atacantes omitir el control de acceso previsto para los archivos HTML por medio de un salto de directorio. Sustituye el car\u00e1cter - por el car\u00e1cter /"}], "id": "CVE-2021-43264", "lastModified": "2026-06-17T04:10:44.987", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-11-02T22:15:09.027", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bugs.launchpad.net/mahara/+bug/1944979"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://mahara.org/interaction/forum/topic.php?id=8954"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bugs.launchpad.net/mahara/+bug/1944979"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://mahara.org/interaction/forum/topic.php?id=8954"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}