9.8

CVE-2017-1000152

Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara, such as an admin changing another user's account settings.

Data is provided by the National Vulnerability Database (NVD)
Mahara ≫ Mahara Version15.04 Updaterc1
Mahara ≫ Mahara Version15.04 Updaterc2
Mahara ≫ Mahara Version15.04.0
Mahara ≫ Mahara Version15.04.1
Mahara ≫ Mahara Version15.04.2
Mahara ≫ Mahara Version15.04.3
Mahara ≫ Mahara Version15.04.4
Mahara ≫ Mahara Version15.04.5
Mahara ≫ Mahara Version15.04.6
Mahara ≫ Mahara Version15.10.0
Mahara ≫ Mahara Version15.10.1
Mahara ≫ Mahara Version15.10.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.34% 0.563
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
https://bugs.launchpad.net/mahara/+bug/1570744
Patch
Third Party Advisory
Issue Tracking