CVE-2017-1000153

CVE-2017-1000153 describes an incorrect access control vulnerability in Mahara versions 15.04.x (before 15.04.10), 15.10.x (before 15.10.6), and 16.04.x (before 16.04.4). This flaw allows an attacker to gain unauthorized access to a user's account if the user changes their email address after a password reset link has been sent, as the old link remains valid. The vulnerability carries a critical CVSS score of 9.8, indicating a severe risk due to its network-based attack vector, low attack complexity, and high potential for compromise of confidentiality, integrity, and availability. An attacker could fully compromise a user's account without requiring any user interaction or prior authentication. Despite its critical severity, there is no evidence of active exploitation, and no public exploit intelligence (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are also minimal, suggesting a low level of public awareness or attention.