CVE-2017-1000150

Published: Nov 3, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks.

Affected (12)

Products: Mahara: Mahara

Mahara

1 product

Mahara

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 15.04.0
Mahara Mahara	Version 15.04.1
Mahara Mahara	Version 15.04.2
Mahara Mahara	Version 15.04.3
Mahara Mahara	Version 15.04.4
Mahara Mahara	Version 15.04.5
Mahara Mahara	Version 15.04.6
Mahara Mahara	Version 15.04 rc1
Mahara Mahara	Version 15.04 rc2

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 15.10.0
Mahara Mahara	Version 15.10.1
Mahara Mahara	Version 15.10.2

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://bugs.launchpad.net/mahara/+bug/1567784

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://bugs.launchpad.net/mahara/+bug/1567784

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.