CVE-2017-1000153
Summary
| CVE | CVE-2017-1000153 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-11-03 18:29:01 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account. |
Risk And Classification
Primary CVSS: v3.0 9.8 CRITICAL from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-732 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mahara | Mahara | 15.04 | rc1 | All | All |
| Application | Mahara | Mahara | 15.04 | rc2 | All | All |
| Application | Mahara | Mahara | 15.04.0 | All | All | All |
| Application | Mahara | Mahara | 15.04.1 | All | All | All |
| Application | Mahara | Mahara | 15.04.2 | All | All | All |
| Application | Mahara | Mahara | 15.04.3 | All | All | All |
| Application | Mahara | Mahara | 15.04.4 | All | All | All |
| Application | Mahara | Mahara | 15.04.5 | All | All | All |
| Application | Mahara | Mahara | 15.04.6 | All | All | All |
| Application | Mahara | Mahara | 15.04.7 | All | All | All |
| Application | Mahara | Mahara | 15.04.8 | All | All | All |
| Application | Mahara | Mahara | 15.04.9 | All | All | All |
| Application | Mahara | Mahara | 15.10.0 | All | All | All |
| Application | Mahara | Mahara | 15.10.1 | All | All | All |
| Application | Mahara | Mahara | 15.10.2 | All | All | All |
| Application | Mahara | Mahara | 15.10.3 | All | All | All |
| Application | Mahara | Mahara | 15.10.4 | All | All | All |
| Application | Mahara | Mahara | 15.10.5 | All | All | All |
| Application | Mahara | Mahara | 16.04 | rc1 | All | All |
| Application | Mahara | Mahara | 16.04 | rc2 | All | All |
| Application | Mahara | Mahara | 16.04.0 | All | All | All |
| Application | Mahara | Mahara | 16.04.1 | All | All | All |
| Application | Mahara | Mahara | 16.04.2 | All | All | All |
| Application | Mahara | Mahara | 16.04.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug #1577251 “Should invalidate password reset links when a user...” : Bugs : Mahara | af854a3a-2127-422b-91ae-364da2661108 | bugs.launchpad.net | Exploit, Issue Tracking, Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.