Vulnerabilities > Mahara > Mahara > 15.04.2
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2017-11-03 | CVE-2017-1000153 | Incorrect Permission Assignment for Critical Resource vulnerability in Mahara Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account. | 7.5 |
2017-11-03 | CVE-2017-1000152 | Unspecified vulnerability in Mahara Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. | 7.5 |
2017-11-03 | CVE-2017-1000151 | Information Exposure vulnerability in Mahara Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to passwords or other sensitive information being passed by unusual parameters to end up in an error log. | 5.0 |
2017-11-03 | CVE-2017-1000150 | Session Fixation vulnerability in Mahara Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. | 6.5 |
2017-11-03 | CVE-2017-1000149 | Cross-site Scripting vulnerability in Mahara Mahara 1.10 before 1.10.9 and 15.04 before 15.04.6 and 15.10 before 15.10.2 are vulnerable to XSS due to window.opener (target="_blank" and window.open()) | 3.5 |
2017-11-03 | CVE-2017-1000148 | Deserialization of Untrusted Data vulnerability in Mahara Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP "unserialize()" function when importing a skin from an XML file. | 6.5 |
2017-11-03 | CVE-2017-1000147 | Cross-Site Request Forgery (CSRF) vulnerability in Mahara Mahara 1.9 before 1.9.8 and 1.10 before 1.10.6 and 15.04 before 15.04.3 are vulnerable to perform a cross-site request forgery (CSRF) attack on the uploader contained in Mahara's filebrowser widget. | 6.0 |
2017-11-03 | CVE-2017-1000133 | Information Exposure vulnerability in Mahara Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to a user - in some circumstances causing another user's artefacts to be included in a Leap2a export of their own pages. | 5.0 |
2017-11-03 | CVE-2017-1000131 | Insufficient Session Expiration vulnerability in Mahara Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they have been logged out of Moodle (when using MNet) as Mahara did not properly implement one of the MNet SSO API functions. | 4.0 |
2017-10-31 | CVE-2017-15273 | Cross-site Scripting vulnerability in Mahara Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload, e.g., XSS code, to be saved as titles in internal artefacts. | 3.5 |