CVE-2017-1000152

Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara, such as an admin changing another user's account settings.

Score
CVSS 3.0 9.8 Critical
Status
Modified - cve@mitre.org
Published
2017-11-03
Last modified
2024-08-05

Affected products

References

 
 
© AVABIS GmbH privacypolicy about