« Volver al listado

CVE-2017-1000153

Estado: ModificadaCrítica (9.8)—

Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mahara — Mahara

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-1000153",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-11-03T18:29:01.027",
  "references": [
    {
      "url": "https://bugs.launchpad.net/mahara/+bug/1577251",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.launchpad.net/mahara/+bug/1577251",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account."
    },
    {
      "lang": "es",
      "value": "Mahara, en versiones 15.04 anteriores a la 15.04.10, versiones 15.10 anteriores a la 15.10.6 y versiones 16.04 anteriores a la 16.04.4, es vulnerable a un control de acceso incorrecto debido a que, después de que se envíe el enlace de restauración de contraseña por correo y el usuario modifique su correo por defecto, Mahara no invalida correctamente el enlace antiguo. Como consecuencia, el enlace del correo se puede utilizar para conseguir acceso a la cuenta del usuario."
    }
  ],
  "lastModified": "2026-06-17T00:58:50.077",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCE2F6EE-06BE-4665-BA7B-AB6C97DAE02D"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "313A5DDA-204F-4ED3-BE22-FA0D8A239BC7"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6932E7F9-BA51-4099-8987-8944E0284B7B"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "022D7031-54EF-484C-B076-15C4342532E3"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FFB08C5-151E-49D2-AC13-1018FF402569"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "853E7231-70C7-4A1F-817F-E43D78BCB060"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "96E14503-4E8B-44F5-9CAB-EF074CA71862"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AD7E980-E0C1-44D1-AFDE-F47CE3A48C71"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C9623EF-7C2D-4A58-AF56-DBD8707CC9EE"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00782DDD-90C9-410F-A810-F5632AD25132"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC2D2EDD-0072-45A5-9FF6-BF4616109DE6"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.04.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8ECDD170-7B22-4F4E-AF8C-BF7698A92FBA"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mahara:mahara:16.04:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1C7261F-8712-4405-A1C0-C36FD9BE64EF"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:16.04:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "74C6846C-42FB-454E-B4BA-0DAA43C1A0C3"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:16.04.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C6F378F-9282-46B4-BF84-B08418C2B592"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:16.04.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28E5C4FE-5195-40FA-8580-2AF84D370B2F"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:16.04.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB5A96D5-CF12-470B-8ADE-183F09D57262"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:16.04.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76D70CE2-AEA2-47B0-83D6-3F8A6E949D7A"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "609A3054-6DA9-44A8-9927-29E181D4D07F"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.10.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5E8584F-8CD3-415C-BFC0-DC825089CA42"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.10.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "023729FA-BEA6-4D89-87B3-C91A7FBDDD46"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.10.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7CEC8639-ECF7-4479-B88E-EA3C3D7F6A0A"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.10.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B04E216C-E51E-44FE-85F0-23C0F1EA9928"
            },
            {
              "criteria": "cpe:2.3:a:mahara:mahara:15.10.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FB9ABF0-E574-4694-A78A-4131D128D895"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}