Vulnerabilities > CVE-2021-40849 - Insufficient Session Expiration vulnerability in Mahara

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
mahara
CWE-613

Summary

In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.

Vulnerable Configurations

Part Description Count
Application
Mahara
296

Common Weakness Enumeration (CWE)