CVEvulnerability

CVE-2017-1000153

9.8 CRITICAL Published 2017-11-03 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-11-03
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-732

Description

Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account.

Affected configurations

• mahara mahara 15.04 • mahara mahara 15.04.0 • mahara mahara 15.04.1 • mahara mahara 15.04.2 • mahara mahara 15.04.3 • mahara mahara 15.04.4 • mahara mahara 15.04.5 • mahara mahara 15.04.6 • mahara mahara 15.04.7 • mahara mahara 15.04.8 • mahara mahara 15.04.9 • mahara mahara 16.04 • mahara mahara 16.04.0 • mahara mahara 16.04.1 • mahara mahara 16.04.2 • mahara mahara 16.04.3 • mahara mahara 15.10.0 • mahara mahara 15.10.1 • mahara mahara 15.10.2 • mahara mahara 15.10.3 • mahara mahara 15.10.4 • mahara mahara 15.10.5

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References