CVE-2017-1000150: High severity mahara vulnerability
Published Nov 3, 2017
·Updated
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks.
Affected Software
12 affected components
Mahara Mahara=15.04-rc1
Mahara Mahara=15.04-rc2
Mahara Mahara=15.04.0
Mahara Mahara=15.04.1
Mahara Mahara=15.04.2
Mahara Mahara=15.04.3
Mahara Mahara=15.04.4
Mahara Mahara=15.04.5
Mahara Mahara=15.04.6
Mahara Mahara=15.10.0
Mahara Mahara=15.10.1
Mahara Mahara=15.10.2
Remediation
Patch Available
Event History
Nov 3, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is CVE-2017-1000150?
CVE-2017-1000150 is a vulnerability in Mahara versions 15.04 before 15.04.7 and 15.10 before 15.10.3 that allows session IDs to be reused, making users vulnerable to session fixation attacks.
2
How severe is CVE-2017-1000150?
CVE-2017-1000150 has a severity value of 8.8, which is considered high.
3
How does CVE-2017-1000150 affect Mahara?
CVE-2017-1000150 affects Mahara versions 15.04 before 15.04.7 and 15.10 before 15.10.3.
4
What is the reference for CVE-2017-1000150?
The reference for CVE-2017-1000150 is https://bugs.launchpad.net/mahara/+bug/1567784.
5
How can I fix CVE-2017-1000150?
To fix CVE-2017-1000150, update your Mahara installation to version 15.04.7 or 15.10.3.