CVEvulnerability

CVE-2017-1000150

8.8 HIGH Published 2017-11-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-11-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-384

Description

Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks.

Affected configurations

• mahara mahara 15.04 • mahara mahara 15.04.0 • mahara mahara 15.04.1 • mahara mahara 15.04.2 • mahara mahara 15.04.3 • mahara mahara 15.04.4 • mahara mahara 15.04.5 • mahara mahara 15.04.6 • mahara mahara 15.10.0 • mahara mahara 15.10.1 • mahara mahara 15.10.2

Related

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References