CVE-2017-1000152

CVE-2017-1000152 describes a critical session management vulnerability in Mahara versions 15.04 prior to 15.04.7 and 15.10 prior to 15.10.3, specifically when running on PHP 5.3. This flaw allows a user to be logged in as another user on a separate computer if an action, such as an administrator modifying account settings, forces the other user to be logged out, leading to the same session ID being served. Rated with a CVSS score of 9.8 (CRITICAL), this vulnerability has a network-based attack vector, low attack complexity, and requires no user interaction, enabling high impacts on confidentiality, integrity, and availability. The EPSS score is low, indicating a low probability of exploitation in the wild. Currently, there is no known active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a low level of public awareness or interest.