[Forgot Password]
Login  Register Subscribe

23631

 
 

126995

 
 

100182

 
 

909

 
 

80298

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2017-1000152

Date: (C)2017-11-07   (M)2017-11-14 


Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara, such as an admin changing another user's account settings.

CVSS Score: 7.5Access Vector: NETWORK
Exploit Score: 10.0Access Complexity: LOW
Impact Score: 6.4Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: PARTIAL
 Availability: PARTIAL





Reference:
https://bugs.launchpad.net/mahara/+bug/1570744

CWE    1
CWE-284

© 2013 SecPod Technologies