CVE-2017-1000155

CVE-2017-1000155 describes an access control vulnerability in Mahara versions 15.04 prior to 15.04.8, 15.10 prior to 15.10.4, and 16.04 prior to 16.04.2. This flaw allows unauthorized access to any of a user's uploaded profile pictures, regardless of whether they are currently designated as the default or used on any pages. Rated with a CVSS score of 4.3 (Medium), the vulnerability has a low attack complexity and requires low privileges for exploitation, potentially leading to information disclosure. The primary impact is the unauthorized viewing of private profile images. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community attention and media coverage.