First published: Fri Nov 03 2017(Updated: )
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to profile pictures being accessed without any access control checks consequently allowing any of a user's uploaded profile pictures to be viewable by anyone, whether or not they were currently selected as the "default" or used in any pages.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Mahara Mahara | =15.04-rc1 | |
Mahara Mahara | =15.04-rc2 | |
Mahara Mahara | =15.04.0 | |
Mahara Mahara | =15.04.1 | |
Mahara Mahara | =15.04.2 | |
Mahara Mahara | =15.04.3 | |
Mahara Mahara | =15.04.4 | |
Mahara Mahara | =15.04.5 | |
Mahara Mahara | =15.04.6 | |
Mahara Mahara | =15.04.7 | |
Mahara Mahara | =16.04-rc1 | |
Mahara Mahara | =16.04-rc2 | |
Mahara Mahara | =16.04.0 | |
Mahara Mahara | =16.04.1 | |
Mahara Mahara | =15.10.0 | |
Mahara Mahara | =15.10.1 | |
Mahara Mahara | =15.10.2 | |
Mahara Mahara | =15.10.3 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this vulnerability is CVE-2017-1000155.
CVE-2017-1000155 has a severity level of medium.
CVE-2017-1000155 allows profile pictures to be accessed without access control checks, making them viewable by anyone.
Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are affected by CVE-2017-1000155.
Yes, a fix is available for CVE-2017-1000155. It is recommended to update to Mahara versions 15.04.8, 15.10.4, or 16.04.2 to mitigate the vulnerability.