CVE-2017-1000156 - Vulnerability Details

Vendors	Products
Mahara	Mahara

Link	Providers
https://bugs.launchpad.net/mahara/+bug/1609200

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "dateAssigned": "2017-08-22T00:00:00", "datePublic": "2017-11-03T00:00:00", "descriptions": [{"lang": "en", "value": "Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-11-03T17:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://bugs.launchpad.net/mahara/+bug/1609200"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2017-08-22T17:29:33.368829", "ID": "CVE-2017-1000156", "REQUESTER": "info@mahara.org", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugs.launchpad.net/mahara/+bug/1609200", "refsource": "MISC", "url": "https://bugs.launchpad.net/mahara/+bug/1609200"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T21:53:07.015Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.launchpad.net/mahara/+bug/1609200"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-1000156", "datePublished": "2017-11-03T18:00:00", "dateReserved": "2017-11-02T00:00:00", "dateUpdated": "2024-08-05T21:53:07.015Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

dateAssigned : 2017-08-22T00:00:00 (string)

datePublic : 2017-11-03T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2017-11-03T17:57:01 (string)

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://bugs.launchpad.net/mahara/+bug/1609200 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cve@mitre.org (string)

DATE_ASSIGNED : 2017-08-22T17:29:33.368829 (string)

ID : CVE-2017-1000156 (string)

REQUESTER : info@mahara.org (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://bugs.launchpad.net/mahara/+bug/1609200 (string)

refsource : MISC (string)

url : https://bugs.launchpad.net/mahara/+bug/1609200 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T21:53:07.015Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://bugs.launchpad.net/mahara/+bug/1609200 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

cveId : CVE-2017-1000156 (string)

datePublished : 2017-11-03T18:00:00 (string)

dateReserved : 2017-11-02T00:00:00 (string)

dateUpdated : 2024-08-05T21:53:07.015Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*", "matchCriteriaId": "DCE2F6EE-06BE-4665-BA7B-AB6C97DAE02D", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*", "matchCriteriaId": "313A5DDA-204F-4ED3-BE22-FA0D8A239BC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:*", "matchCriteriaId": "6932E7F9-BA51-4099-8987-8944E0284B7B", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:*", "matchCriteriaId": "022D7031-54EF-484C-B076-15C4342532E3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:*", "matchCriteriaId": "6FFB08C5-151E-49D2-AC13-1018FF402569", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.3:*:*:*:*:*:*:*", "matchCriteriaId": "853E7231-70C7-4A1F-817F-E43D78BCB060", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.4:*:*:*:*:*:*:*", "matchCriteriaId": "96E14503-4E8B-44F5-9CAB-EF074CA71862", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.5:*:*:*:*:*:*:*", "matchCriteriaId": "9AD7E980-E0C1-44D1-AFDE-F47CE3A48C71", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.6:*:*:*:*:*:*:*", "matchCriteriaId": "9C9623EF-7C2D-4A58-AF56-DBD8707CC9EE", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.7:*:*:*:*:*:*:*", "matchCriteriaId": "00782DDD-90C9-410F-A810-F5632AD25132", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.04.8:*:*:*:*:*:*:*", "matchCriteriaId": "EC2D2EDD-0072-45A5-9FF6-BF4616109DE6", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:16.04:rc1:*:*:*:*:*:*", "matchCriteriaId": "C1C7261F-8712-4405-A1C0-C36FD9BE64EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:16.04:rc2:*:*:*:*:*:*", "matchCriteriaId": "74C6846C-42FB-454E-B4BA-0DAA43C1A0C3", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:16.04.0:*:*:*:*:*:*:*", "matchCriteriaId": "6C6F378F-9282-46B4-BF84-B08418C2B592", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:16.04.1:*:*:*:*:*:*:*", "matchCriteriaId": "28E5C4FE-5195-40FA-8580-2AF84D370B2F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:16.04.2:*:*:*:*:*:*:*", "matchCriteriaId": "BB5A96D5-CF12-470B-8ADE-183F09D57262", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mahara:mahara:15.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "609A3054-6DA9-44A8-9927-29E181D4D07F", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.10.1:*:*:*:*:*:*:*", "matchCriteriaId": "E5E8584F-8CD3-415C-BFC0-DC825089CA42", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.10.2:*:*:*:*:*:*:*", "matchCriteriaId": "023729FA-BEA6-4D89-87B3-C91A7FBDDD46", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.10.3:*:*:*:*:*:*:*", "matchCriteriaId": "7CEC8639-ECF7-4479-B88E-EA3C3D7F6A0A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mahara:mahara:15.10.4:*:*:*:*:*:*:*", "matchCriteriaId": "B04E216C-E51E-44FE-85F0-23C0F1EA9928", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role."}, {"lang": "es", "value": "Mahara, en versiones 15.04 anteriores a la 15.04.9, versiones 15.10 anteriores a la 15.10.5 y versiones 16.04 anteriores a la 16.04.3, es vulnerable a que cualquier miembro de un grupo pueda editar la p\u00e1gina de configuraci\u00f3n del grupo, incluso si este no tiene el rol de administrador."}], "id": "CVE-2017-1000156", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-11-03T18:29:01.137", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugs.launchpad.net/mahara/+bug/1609200"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugs.launchpad.net/mahara/+bug/1609200"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:* (string)

matchCriteriaId : DCE2F6EE-06BE-4665-BA7B-AB6C97DAE02D (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:* (string)

matchCriteriaId : 313A5DDA-204F-4ED3-BE22-FA0D8A239BC7 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 6932E7F9-BA51-4099-8987-8944E0284B7B (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 022D7031-54EF-484C-B076-15C4342532E3 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 6FFB08C5-151E-49D2-AC13-1018FF402569 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 853E7231-70C7-4A1F-817F-E43D78BCB060 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.4:*:*:*:*:*:*:* (string)

matchCriteriaId : 96E14503-4E8B-44F5-9CAB-EF074CA71862 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.5:*:*:*:*:*:*:* (string)

matchCriteriaId : 9AD7E980-E0C1-44D1-AFDE-F47CE3A48C71 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 9C9623EF-7C2D-4A58-AF56-DBD8707CC9EE (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.7:*:*:*:*:*:*:* (string)

matchCriteriaId : 00782DDD-90C9-410F-A810-F5632AD25132 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:mahara:mahara:15.04.8:*:*:*:*:*:*:* (string)

matchCriteriaId : EC2D2EDD-0072-45A5-9FF6-BF4616109DE6 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mahara:mahara:16.04:rc1:*:*:*:*:*:* (string)

matchCriteriaId : C1C7261F-8712-4405-A1C0-C36FD9BE64EF (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mahara:mahara:16.04:rc2:*:*:*:*:*:* (string)

matchCriteriaId : 74C6846C-42FB-454E-B4BA-0DAA43C1A0C3 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mahara:mahara:16.04.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 6C6F378F-9282-46B4-BF84-B08418C2B592 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:mahara:mahara:16.04.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 28E5C4FE-5195-40FA-8580-2AF84D370B2F (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:mahara:mahara:16.04.2:*:*:*:*:*:*:* (string)

matchCriteriaId : BB5A96D5-CF12-470B-8ADE-183F09D57262 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mahara:mahara:15.10.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 609A3054-6DA9-44A8-9927-29E181D4D07F (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mahara:mahara:15.10.1:*:*:*:*:*:*:* (string)

matchCriteriaId : E5E8584F-8CD3-415C-BFC0-DC825089CA42 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mahara:mahara:15.10.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 023729FA-BEA6-4D89-87B3-C91A7FBDDD46 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:mahara:mahara:15.10.3:*:*:*:*:*:*:* (string)

matchCriteriaId : 7CEC8639-ECF7-4479-B88E-EA3C3D7F6A0A (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:mahara:mahara:15.10.4:*:*:*:*:*:*:* (string)

matchCriteriaId : B04E216C-E51E-44FE-85F0-23C0F1EA9928 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable by any group member even when they didn't have the admin role. (string)

}

1 : { »

lang : es (string)

value : Mahara, en versiones 15.04 anteriores a la 15.04.9, versiones 15.10 anteriores a la 15.10.5 y versiones 16.04 anteriores a la 16.04.3, es vulnerable a que cualquier miembro de un grupo pueda editar la página de configuración del grupo, incluso si este no tiene el rol de administrador. (string)

}

]

id : CVE-2017-1000156 (string)

lastModified : 2025-04-20T01:37:25.860 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 5.5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:L/Au:S/C:P/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8 (number)

impactScore : 4.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.2 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-11-03T18:29:01.137 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Patch (string)

3 : Third Party Advisory (string)

]

url : https://bugs.launchpad.net/mahara/+bug/1609200 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Patch (string)

3 : Third Party Advisory (string)

]

url : https://bugs.launchpad.net/mahara/+bug/1609200 (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-269 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object