CVE-2017-1000152
CriticalSummary
Mahara versions 15.04 before 15.04.7 and 15.10 before 15.10.3 running on PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer due to the same session ID being served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara.
Risk Assessment
The risk to the organization is that users may gain access to other users' accounts, leading to potential breaches of privacy and data security.
Recommendation
It is recommended to update Mahara to versions 15.04.7 or 15.10.3 to mitigate this vulnerability and to monitor user sessions for unauthorized logins.
Original NVD description (English source)
Mahara 15.04 before 15.04.7 and 15.10 before 15.10.3 running PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer as the same session ID is served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara, such as an admin changing another user's account settings.