{"id":"CVE-2022-33913","details":"In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check.","modified":"2026-08-12T03:51:24.731040480Z","published":"2022-06-20T15:26:25Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33913.json","unresolved_ranges":[{"extracted_events":[{"introduced":"21.04"},{"fixed":"21.04.6"},{"introduced":"21.10"},{"fixed":"21.10.4"},{"fixed":"thumb.php"}],"source":"DESCRIPTION"}],"cna_assigner":"mitre"},"references":[{"type":"WEB","url":"https://mahara.org/interaction/forum/topic.php?id=9138"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/33xxx/CVE-2022-33913.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33913"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/maharaproject/mahara","events":[{"introduced":"359597b32c7afe52339422a91f14256e17b33dfc"},{"fixed":"da70ffe6f905070c6cd77e0bb5db08743b5d6013"},{"introduced":"9b0da78a1f8585b142a372d422bf5d9a36e1450d"},{"fixed":"797a3743980c96a7579e43e0f271f2298c8a9193"},{"introduced":"dab8850ef93f62f5c6d91d9f15ff3d8c5c7d2a49"},{"last_affected":"dab8850ef93f62f5c6d91d9f15ff3d8c5c7d2a49"}],"database_specific":{"cpe":["cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:22.04.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"21.04.0"},{"fixed":"21.04.6"},{"introduced":"21.10.0"},{"fixed":"21.10.4"},{"introduced":"22.04.2"},{"last_affected":"22.04.2"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["22.04.2","22.04.2_RELEASE","21.10.3_RELEASE","21.04.5_RELEASE","21.04.4_RELEASE","21.10.2_RELEASE","21.10.1_RELEASE","21.04.3_RELEASE","21.04.2_RELEASE","21.10.0_RELEASE","21.04.1_RELEASE","21.04.0_RELEASE"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-33913.json"}}],"schema_version":"1.9.0"}