CVE-2017-1000154
CriticalSummary
Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to some authentication methods that do not use Mahara's built-in login form, allowing users to log in even if their institution was expired or suspended.
Risk Assessment
The risk is that users may gain access to the system despite their accounts being expired or suspended, potentially leading to unauthorized access to data.
Recommendation
It is recommended to update Mahara to the latest version to eliminate this vulnerability and ensure that all authentication methods use the built-in login form.
Original NVD description (English source)
Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to some authentication methods, which do not use Mahara's built-in login form, still allowing users to log in even if their institution was expired or suspended.