CVE-2017-14163

Published: Oct 31, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without logging out of Mahara, the value in the usr_session table is not removed. If someone were to open a browser, visit the Mahara site, and adjust the 'mahara' cookie to the old value, they can get access to the user's account.

Affected (38)

Products: Mahara: Mahara

Mahara

1 product

Mahara

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 15.04.0
Mahara Mahara	Version 15.04.10
Mahara Mahara	Version 15.04.11
Mahara Mahara	Version 15.04.12
Mahara Mahara	Version 15.04.13
Mahara Mahara	Version 15.04.1
Mahara Mahara	Version 15.04.2
Mahara Mahara	Version 15.04.3
Mahara Mahara	Version 15.04.4
Mahara Mahara	Version 15.04.5
Mahara Mahara	Version 15.04.6
Mahara Mahara	Version 15.04.7
Mahara Mahara	Version 15.04.8
Mahara Mahara	Version 15.04.9
Mahara Mahara	Version 15.04 rc1
Mahara Mahara	Version 15.04 rc2

Configuration B

10 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 16.04.0
Mahara Mahara	Version 16.04.1
Mahara Mahara	Version 16.04.2
Mahara Mahara	Version 16.04.3
Mahara Mahara	Version 16.04.4
Mahara Mahara	Version 16.04.5
Mahara Mahara	Version 16.04.6
Mahara Mahara	Version 16.04.7
Mahara Mahara	Version 16.04 rc1
Mahara Mahara	Version 16.04 rc2

Configuration C

7 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 16.10.0
Mahara Mahara	Version 16.10.1
Mahara Mahara	Version 16.10.2
Mahara Mahara	Version 16.10.3
Mahara Mahara	Version 16.10.4
Mahara Mahara	Version 16.10 rc1
Mahara Mahara	Version 16.10 rc2

Configuration D

5 vulnerable

Vulnerable Software	Affected Versions
Mahara Mahara	Version 17.04.0
Mahara Mahara	Version 17.04.1
Mahara Mahara	Version 17.04.2
Mahara Mahara	Version 17.04 rc1
Mahara Mahara	Version 17.04 rc2

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (2)

https://bugs.launchpad.net/mahara/+bug/1701978

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://bugs.launchpad.net/mahara/+bug/1701978

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.