CVE-2017-1000136

MEDIUM

Mahara <1.8.6, <1.9.4, <1.10.1, <15.04.0 - Info Disclosure

Title source: llm
STIX 2.1

Description

Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable to old sessions not being invalidated after a password change.

References (1)

Core 1
Core References
Exploit, Issue Tracking, Mitigation, Patch, Third Party Advisory x_refsource_misc
https://bugs.launchpad.net/mahara/+bug/1363873

Scores

CVSS v3 6.5
EPSS 0.0089
EPSS Percentile 54.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Details

CWE
CWE-613
Status published
Products (15)
mahara/mahara 1.8 rc1 (2 CPE variants)
mahara/mahara 1.8.0
mahara/mahara 1.8.1
mahara/mahara 1.8.2
mahara/mahara 1.8.3
mahara/mahara 1.8.4
mahara/mahara 1.8.5
mahara/mahara 1.9 rc1
mahara/mahara 1.9.0
mahara/mahara 1.9.1
... and 5 more
Published Nov 03, 2017
Tracked Since Feb 18, 2026