A critical information disclosure vulnerability in Mahara allows unauthenticated attackers to view sensitive database connection credentials when the application loses connectivity.

The application fails to properly handle error states, resulting in the leakage of database connection strings to the end user during service interruptions. This vulnerability is accessible to unauthenticated remote attackers.

The exposure of database connection strings poses a severe risk to the confidentiality and integrity of the entire Mahara environment. An attacker obtaining these credentials could potentially gain unauthorized access to the underlying database, leading to mass data exfiltration or complete system compromise. Given the CVSS score of 7.5, this high-severity flaw requires immediate attention to prevent unauthorized administrative access to backend infrastructure.

Immediate Action: Upgrade Mahara to version 24.04.9 or later to ensure the application securely handles database connection errors.

Proactive Monitoring: Review application error logs for frequent database connection timeouts or failures that could trigger the disclosure of sensitive configuration details.

Compensating Controls: Ensure that web server error pages are configured to display generic messages rather than detailed system stack traces or configuration errors to the end user.

Public Exploit Available: No.

This vulnerability represents a significant security oversight that could lead to full database compromise. Administrators must prioritize the application of the 24.04.9 update across all instances. Failure to remediate this issue leaves the backend database credentials exposed to any remote actor capable of inducing a temporary service disruption.