CVE-2017-1000155

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to profile pictures being accessed without any access control checks consequently allowing any of a user's uploaded profile pictures to be viewable by anyone, whether or not they were currently selected as the "default" or used in any pages.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Nov 3, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-10001566.5Mahara 15.04 before 15.04.9 and 15.10 before 15.10.5 and 16.04 before 16.04.3 are vulnerable to a group's configuration page being editable CVE-2017-10001574.4Mahara 15.04 before 15.04.13 and 16.04 before 16.04.7 and 16.10 before 16.10.4 and 17.04 before 17.04.2 are vulnerable to recording plain teCVE-2017-10001589.8CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow in the PyString_DecodeEscape function in stringobject.c, resulting inCVE-2017-10001597.8Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.CVE-2017-10001605.4EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting resulting in PHP code injectionCVE-2017-10001636.1The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 are vulnerable to unvalidated URL redirCVE-2017-10001645.4Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalationCVE-2017-10001686.5sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate public keysCVE-2017-10001699.8QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lead to the complete takCVE-2017-10001707.5jqueryFileTree 2.1.5 and older Directory TraversalCVE-2017-10001719.8Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.CVE-2017-10001729.8Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. An example of a Heap-Use-After-Free after the 'sublexer' pointer has b
CVE-2017-1000155: Medium severity, CVSS 4.3 | Vulnix