CVE-2017-1000150
HighSummary
Mahara versions 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to not regenerating session IDs on login or logout. This increases the risk of session fixation attacks for site users.
Risk Assessment
The lack of session ID regeneration may lead to session hijacking by unauthorized users, compromising user data security.
Recommendation
It is recommended to update Mahara to versions 15.04.7 or 15.10.3 to mitigate this vulnerability.
Other vulnerabilities in Mahara
See all- CVE-2017-1000151High
Mahara versions 15.04 before 15.04.9, 15.10 before 15.10.5, and 16.04 before 16.04.3 are vulnerable to passwords or other sensitive information being passed by unusual parameters to end up in an error log.
- CVE-2017-1000148High
Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP 'unserialize()' function when importing a skin from an XML file.
- CVE-2017-1000139High
Mahara versions 1.8 before 1.8.7, 1.9 before 1.9.5, 1.10 before 1.10.3, and 15.04 before 15.04.0 are vulnerable to server-side request forgery (SSRF) attacks due to not checking all curl redirect processes against a white or black list.
- CVE-2017-1000134High
Mahara versions 1.8 before 1.8.6, 1.9 before 1.9.4, 1.10 before 1.10.1, and 15.04 before 15.04.0 are vulnerable due to group members potentially losing access to group files they uploaded if another group member changes the access permissions on them.
- CVE-2017-1000133High
Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to a user causing another user's artefacts to be included in a Leap2a export of their own pages under certain circumstances.
- CVE-2017-14163High
An issue exists in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3 that allows access to a user's account after closing the browser without logging out. The value in the usr_session table is not removed, enabling access to the account by reopening the browser and adjusting the 'mahara' cookie to the old value.
- CVE-2026-42164Critical
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
- CVE-2026-42162Critical
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.
- CVE-2026-42163Critical
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
- CVE-2017-1000154Critical
Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to some authentication methods that do not use Mahara's built-in login form, allowing users to log in even if their institution was expired or suspended.
Original NVD description (English source)
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to prevent session IDs from being regenerated on login or logout. This makes users of the site more vulnerable to session fixation attacks.