PT-2018-5164 · Catalyst It · Mahara

Published 2018-01-30 · Updated 2018-06-13 · CVE-2017-1000141

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 18.10.0

Description An issue was discovered that mishandled user requests, potentially discontinuing a user's ability to maintain their own account. This includes actions such as changing the username, changing the primary email address, or deleting the account. The correct behavior should have been to prompt the user for their password and/or send a warning to their primary email address.

Recommendations For versions prior to 18.10.0, update to version 18.10.0 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2017-1000141

Affected Products

Mahara

References · 4

• https://osv.dev/vulnerability/CVE-2017-1000141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000141 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000141 · Note
• https://bugs.launchpad.net/mahara/+bug/1422492 · Note