{"id":"CVE-2017-14163","details":"An issue was discovered in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3. When one closes the browser without logging out of Mahara, the value in the usr_session table is not removed. If someone were to open a browser, visit the Mahara site, and adjust the 'mahara' cookie to the old value, they can get access to the user's account.","modified":"2026-07-08T11:47:33.469867Z","published":"2017-10-31T18:29:00.250Z","references":[{"type":"FIX","url":"https://bugs.launchpad.net/mahara/+bug/1701978"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/maharaproject/mahara","events":[{"introduced":"48a238a2f76a7ea322580fe93b7c026becd9acce"},{"last_affected":"2e5d0ff8ba15844e22c1a4faaa3bd71263dff0bf"}],"database_specific":{"extracted_events":[{"introduced":"15.04-rc1"},{"last_affected":"15.04-rc1"},{"introduced":"15.04-rc2"},{"last_affected":"15.04-rc2"},{"introduced":"15.04.0"},{"last_affected":"15.04.0"},{"introduced":"15.04.1"},{"last_affected":"15.04.1"},{"introduced":"15.04.2"},{"last_affected":"15.04.2"},{"introduced":"15.04.3"},{"last_affected":"15.04.3"},{"introduced":"15.04.4"},{"last_affected":"15.04.4"},{"introduced":"15.04.5"},{"last_affected":"15.04.5"},{"introduced":"15.04.6"},{"last_affected":"15.04.6"},{"introduced":"15.04.7"},{"last_affected":"15.04.7"},{"introduced":"15.04.8"},{"last_affected":"15.04.8"},{"introduced":"15.04.9"},{"last_affected":"15.04.9"},{"introduced":"15.04.10"},{"last_affected":"15.04.10"},{"introduced":"15.04.11"},{"last_affected":"15.04.11"},{"introduced":"15.04.12"},{"last_affected":"15.04.12"},{"introduced":"15.04.13"},{"last_affected":"15.04.13"},{"introduced":"16.04-rc1"},{"last_affected":"16.04-rc1"},{"introduced":"16.04-rc2"},{"last_affected":"16.04-rc2"},{"introduced":"16.04.0"},{"last_affected":"16.04.0"},{"introduced":"16.04.1"},{"last_affected":"16.04.1"},{"introduced":"16.04.2"},{"last_affected":"16.04.2"},{"introduced":"16.04.3"},{"last_affected":"16.04.3"},{"introduced":"16.04.4"},{"last_affected":"16.04.4"},{"introduced":"16.04.5"},{"last_affected":"16.04.5"},{"introduced":"16.04.6"},{"last_affected":"16.04.6"},{"introduced":"16.04.7"},{"last_affected":"16.04.7"},{"introduced":"16.10-rc1"},{"last_affected":"16.10-rc1"},{"introduced":"16.10-rc2"},{"last_affected":"16.10-rc2"},{"introduced":"16.10.0"},{"last_affected":"16.10.0"},{"introduced":"16.10.1"},{"last_affected":"16.10.1"},{"introduced":"16.10.2"},{"last_affected":"16.10.2"},{"introduced":"16.10.3"},{"last_affected":"16.10.3"},{"introduced":"16.10.4"},{"last_affected":"16.10.4"},{"introduced":"17.04-rc1"},{"last_affected":"17.04-rc1"},{"introduced":"17.04-rc2"},{"last_affected":"17.04-rc2"},{"introduced":"17.04.0"},{"last_affected":"17.04.0"},{"introduced":"17.04.1"},{"last_affected":"17.04.1"},{"introduced":"17.04.2"},{"last_affected":"17.04.2"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:mahara:mahara:15.04:rc1:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04:rc2:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.0:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.2:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.3:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.4:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.5:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.6:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.7:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.8:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.9:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.10:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.11:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.12:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:15.04.13:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04:rc1:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04:rc2:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04.0:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04.2:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04.3:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04.4:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04.5:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04.6:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.04.7:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.10:rc1:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.10:rc2:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.10.0:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.10.1:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.10.2:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.10.3:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:16.10.4:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:17.04:rc1:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:17.04:rc2:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:17.04.0:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:17.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mahara:mahara:17.04.2:*:*:*:*:*:*:*"]}}],"versions":["15.04-rc1","15.04-rc2","15.04.0","15.04.1","15.04.10","15.04.11","15.04.12","15.04.13","15.04.2","15.04.3","15.04.4","15.04.5","15.04.6","15.04.7","15.04.8","15.04.9","16.04-rc1","16.04-rc2","16.04.0","16.04.1","16.04.2","16.04.3","16.04.4","16.04.5","16.04.6","16.04.7","16.10-rc1","16.10-rc2","16.10.0","16.10.1","16.10.2","16.10.3","16.10.4","17.04-rc1","17.04-rc2","17.04.0","17.04.1","17.04.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14163.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}