Critical
Security advisory
Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-1000153
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:46 UTC · Revision 1
Source evidence
Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account.
osv:CVE-2017-1000153
Complete source record
{
"id": "91b5b65823fe0b7a26886c85734b59898289df569c70475133317c9a28068421",
"url": "https://osv.dev/vulnerability/CVE-2017-1000153",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-1000153",
"summary": "Mahara 15.04 before 15.04.10 and 15.10 before 15.10.6 and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email and then user changes default email, Mahara fails to invalidate old link.Consequently the link in email can be used to gain access to the user's account.",
"evidence": "osv:CVE-2017-1000153",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2017-1000153",
"aliases": [
"CVE-2017-1000153"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/maharaproject/mahara",
"type": "GIT",
"events": [
{
"introduced": "48a238a2f76a7ea322580fe93b7c026becd9acce"
},
{
"last_affected": "7555fd2d8dc30bbf3c0ed6a95f4b9a045500c0dc"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04-rc1"
},
{
"last_affected": "15.04-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04-rc2"
},
{
"last_affected": "15.04-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.0"
},
{
"last_affected": "15.04.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.1"
},
{
"last_affected": "15.04.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.2"
},
{
"last_affected": "15.04.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.3"
},
{
"last_affected": "15.04.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.4"
},
{
"last_affected": "15.04.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.5"
},
{
"last_affected": "15.04.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.6"
},
{
"last_affected": "15.04.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.7"
},
{
"last_affected": "15.04.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.8"
},
{
"last_affected": "15.04.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.04.9:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.04.9"
},
{
"last_affected": "15.04.9"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04-rc1"
},
{
"last_affected": "16.04-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04:rc2:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04-rc2"
},
{
"last_affected": "16.04-rc2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04.0"
},
{
"last_affected": "16.04.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04.1"
},
{
"last_affected": "16.04.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04.2"
},
{
"last_affected": "16.04.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:16.04.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.04.3"
},
{
"last_affected": "16.04.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.0"
},
{
"last_affected": "15.10.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.1"
},
{
"last_affected": "15.10.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.2"
},
{
"last_affected": "15.10.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.3"
},
{
"last_affected": "15.10.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.4"
},
{
"last_affected": "15.10.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:mahara:mahara:15.10.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "15.10.5"
},
{
"last_affected": "15.10.5"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"15.04-rc1",
"15.04-rc2",
"15.04.0",
"15.04.1",
"15.04.2",
"15.04.3",
"15.04.4",
"15.04.5",
"15.04.6",
"15.04.7",
"15.04.8",
"15.04.9",
"15.10.0",
"15.10.1",
"15.10.2",
"15.10.3",
"15.10.4",
"15.10.5",
"16.04-rc1",
"16.04-rc2",
"16.04.0",
"16.04.1",
"16.04.2",
"16.04.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-1000153.json"
}
}
],
"modified": "2026-10-24T10:30:44.219653373Z",
"provider": "osv",
"references": [
"https://bugs.launchpad.net/mahara/+bug/1577251"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2017-1000153",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 435822,
"published_at": "2017-11-03T18:29:01.027+00:00"
}