CVE-2017-1000157: Infoleak

Published Nov 3, 2017

Updated

Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain text passwords in the eventlog table during the user creation process if full event logging was turned on.

Affected Software

34 affected components

Mahara Mahara=15.04-rc1

Mahara Mahara=15.04-rc2

Mahara Mahara=15.04.0

Mahara Mahara=15.04.1

Mahara Mahara=15.04.2

Mahara Mahara=15.04.3

Mahara Mahara=15.04.4

Mahara Mahara=15.04.5

Mahara Mahara=15.04.6

Mahara Mahara=15.04.7

Mahara Mahara=15.04.8

Mahara Mahara=15.04.9

Mahara Mahara=15.04.10

Mahara Mahara=15.04.11

Mahara Mahara=15.04.12

Mahara Mahara=16.04-rc1

Mahara Mahara=16.04-rc2

Mahara Mahara=16.04.0

Mahara Mahara=16.04.1

Mahara Mahara=16.04.2

Mahara Mahara=16.04.3

Mahara Mahara=16.04.4

Mahara Mahara=16.04.5

Mahara Mahara=16.04.6

Mahara Mahara=16.10-rc1

Mahara Mahara=16.10-rc2

Mahara Mahara=16.10.0

Mahara Mahara=16.10.1

Mahara Mahara=16.10.2

Mahara Mahara=16.10.3

Mahara Mahara=17.04-rc1

Mahara Mahara=17.04-rc2

Mahara Mahara=17.04.0

Mahara Mahara=17.04.1

Remediation

Patch Available

https://bugs.launchpad.net/mahara/+bug/1692749

Event History

Nov 3, 2017

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is CVE-2017-1000157 vulnerability?

CVE-2017-1000157 is a vulnerability in Mahara versions 15.04 to 17.04.2 that allows plain text passwords to be recorded in the event_log table during the user creation process.

How severe is CVE-2017-1000157 vulnerability?

CVE-2017-1000157 has a severity rating of 4.4 out of 10.

What is the affected software for CVE-2017-1000157 vulnerability?

The affected software for CVE-2017-1000157 vulnerability is Mahara versions 15.04 to 17.04.2.

How can I fix CVE-2017-1000157 vulnerability?

To fix CVE-2017-1000157 vulnerability, upgrade to Mahara versions 15.04.13, 16.04.7, 16.10.4, or 17.04.2.

Where can I find more information about CVE-2017-1000157 vulnerability?

You can find more information about CVE-2017-1000157 vulnerability at the following link: [CVE-2017-1000157](https://bugs.launchpad.net/mahara/+bug/1692749).