CVE-2017-1000134: High severity mahara vulnerability

Published Nov 3, 2017

Updated

Mahara 1.8 before 1.8.6 and 1.9 before 1.9.4 and 1.10 before 1.10.1 and 15.04 before 15.04.0 are vulnerable because group members can lose access to the group files they uploaded if another group member changes the access permissions on them.

Affected Software

17 affected components

Mahara Mahara=1.8-rc1

Mahara Mahara=1.8-rc2

Mahara Mahara=1.8.0

Mahara Mahara=1.8.1

Mahara Mahara=1.8.2

Mahara Mahara=1.8.3

Mahara Mahara=1.8.4

Mahara Mahara=1.8.5

Mahara Mahara=1.9-rc1

Mahara Mahara=1.9.0

Mahara Mahara=1.9.1

Mahara Mahara=1.9.2

Mahara Mahara=1.9.3

Mahara Mahara=1.10-rc1

Mahara Mahara=1.10.0

Mahara Mahara=15.04-rc1

Mahara Mahara=15.04-rc2

Remediation

Patch Available

https://bugs.launchpad.net/mahara/+bug/1267686

Event History

Nov 3, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is CVE-2017-1000134?

CVE-2017-1000134 is a vulnerability in Mahara versions 1.8 before 1.8.6, 1.9 before 1.9.4, 1.10 before 1.10.1, and 15.04 before 15.04.0.

What is the severity of CVE-2017-1000134?

The severity of CVE-2017-1000134 is high with a CVSS score of 8.1.

How does CVE-2017-1000134 affect Mahara?

CVE-2017-1000134 allows group members to lose access to their uploaded files if another member changes the access permissions on them.

Which versions of Mahara are affected by CVE-2017-1000134?

Mahara versions 1.8 before 1.8.6, 1.9 before 1.9.4, 1.10 before 1.10.1, and 15.04 before 15.04.0 are affected by CVE-2017-1000134.

How can I fix CVE-2017-1000134?

To fix CVE-2017-1000134, update your Mahara installation to version 1.8.6, 1.9.4, 1.10.1, or 15.04.0.