What’s Vulnerable › Vulnerabilities
CVE-2017-1000152
- Severity: critical (CVSS 9.8 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2017-11-03 · updated 2026-06-17
Description
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara, such as an admin changing another user's account settings.
Affected products
- mahara: 15.04-rc1, 15.04-rc2, 15.04.0, 15.04.1, 15.04.2, 15.04.3 (+6)
References
Get alerted when CVE-2017-1000152 or the next vulnerability affects your stack