How severe is CVE-2024-47192?

CVE-2024-47192 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-47192 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-47192?

CVE-2024-47192 affects Mahara. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-47192?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-47192 have an EU (EUVD) identifier?

Yes. CVE-2024-47192 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54914.

When was CVE-2024-47192 published?

CVE-2024-47192 was published on 2025-08-26 and last updated on 2026-06-17.

CVE-2024-47192

CVE-2024-47192 is a medium-severity vulnerability in Mahara with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-494.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (5th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-54914
Weakness: CWE-494
Affected product: Mahara
Published: 2025-08-26
Last modified: 2026-06-17

Description

An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have permission to download.

Frequently asked questions

What is CVE-2024-47192?: An issue was discovered in Mahara 23.04.8 and 24.04.4. The use of a malicious export download URL can allow an attacker to download files that they do not have permission to download.
How severe is CVE-2024-47192?: CVE-2024-47192 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-47192 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-47192?: CVE-2024-47192 affects Mahara. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-47192?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-47192 have an EU (EUVD) identifier?: Yes. CVE-2024-47192 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54914.
When was CVE-2024-47192 published?: CVE-2024-47192 was published on 2025-08-26 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mahara:mahara:*:*:*:*:*:*:*:*

More vulnerabilities in Mahara

CVE-2022-45134 — Critical (CVSS 9.8): Mahara 21.10 before 21.10.6, 22.04 before 22.04.4, and 22.10 before 22.10.1 deserializes user input unsafely during…
CVE-2022-44544 — Critical (CVSS 9.8): Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a…
CVE-2021-40849 — Critical (CVSS 9.8): In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable…
CVE-2017-1000154 — Critical (CVSS 9.8): Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication…
CVE-2017-1000153 — Critical (CVSS 9.8): Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access…
CVE-2017-1000152 — Critical (CVSS 9.8): Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as…

All CVEs affecting Mahara →

Other CWE-494 vulnerabilities

CVE-2020-1595 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from…
CVE-2020-1210 — Critical (CVSS 9.9): <p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source…
CVE-2026-42248 — Critical (CVSS 9.8): Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike…
CVE-2026-34841 — Critical (CVSS 9.8): Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack…
CVE-2026-3000 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…
CVE-2026-2999 — Critical (CVSS 9.8): IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated…

Browse all CWE-494 vulnerabilities →