CVE-2017-14163
HighSummary
An issue exists in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3 that allows access to a user's account after closing the browser without logging out. The value in the usr_session table is not removed, enabling access to the account by reopening the browser and adjusting the 'mahara' cookie to the old value.
Risk Assessment
The organization may be exposed to unauthorized access to user accounts, potentially leading to data leaks or other malicious activities.
Recommendation
It is recommended to update Mahara to the latest version to eliminate this vulnerability and implement a policy that forces user logout upon closing the browser.
Other vulnerabilities in Mahara
See all- CVE-2017-1000151High
Mahara versions 15.04 before 15.04.9, 15.10 before 15.10.5, and 16.04 before 16.04.3 are vulnerable to passwords or other sensitive information being passed by unusual parameters to end up in an error log.
- CVE-2017-1000150High
Mahara versions 15.04 before 15.04.7 and 15.10 before 15.10.3 are vulnerable to not regenerating session IDs on login or logout. This increases the risk of session fixation attacks for site users.
- CVE-2017-1000148High
Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to PHP code execution as Mahara would pass portions of the XML through the PHP 'unserialize()' function when importing a skin from an XML file.
- CVE-2017-1000139High
Mahara versions 1.8 before 1.8.7, 1.9 before 1.9.5, 1.10 before 1.10.3, and 15.04 before 15.04.0 are vulnerable to server-side request forgery (SSRF) attacks due to not checking all curl redirect processes against a white or black list.
- CVE-2017-1000134High
Mahara versions 1.8 before 1.8.6, 1.9 before 1.9.4, 1.10 before 1.10.1, and 15.04 before 15.04.0 are vulnerable due to group members potentially losing access to group files they uploaded if another group member changes the access permissions on them.
- CVE-2017-1000133High
Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to a user causing another user's artefacts to be included in a Leap2a export of their own pages under certain circumstances.
- CVE-2026-42164Critical
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section.
- CVE-2026-42162Critical
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated.
- CVE-2026-42163Critical
Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.
- CVE-2017-1000154Critical
Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to some authentication methods that do not use Mahara's built-in login form, allowing users to log in even if their institution was expired or suspended.
Original NVD description (English source)
An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without logging out of Mahara, the value in the usr_session table is not removed. If someone were to open a browser, visit the Mahara site, and adjust the 'mahara' cookie to the old value, they can get access to the user's account.