9.8

CVE-2017-1000154

Exploit

Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in login form, still allowing users to log in even if their institution was expired or suspended.

Data is provided by the National Vulnerability Database (NVD)
Mahara ≫ Mahara Version15.04 Updaterc1
Mahara ≫ Mahara Version15.04 Updaterc2
Mahara ≫ Mahara Version15.04.0
Mahara ≫ Mahara Version15.04.1
Mahara ≫ Mahara Version15.04.2
Mahara ≫ Mahara Version15.04.3
Mahara ≫ Mahara Version15.04.4
Mahara ≫ Mahara Version15.04.5
Mahara ≫ Mahara Version15.04.6
Mahara ≫ Mahara Version15.04.7
Mahara ≫ Mahara Version16.04 Updaterc1
Mahara ≫ Mahara Version16.04 Updaterc2
Mahara ≫ Mahara Version16.04.0
Mahara ≫ Mahara Version16.04.1
Mahara ≫ Mahara Version15.10.0
Mahara ≫ Mahara Version15.10.1
Mahara ≫ Mahara Version15.10.2
Mahara ≫ Mahara Version15.10.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.61% 0.687
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

https://bugs.launchpad.net/mahara/+bug/1580399
Patch
Third Party Advisory
Exploit
Issue Tracking