CVE-2017-17455

low-risk

Published 2018-02-20

Mahara 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to being forced, via a man-in-the-middle attack, to interact with Mahara on the HTTP protocol rather than HTTPS even when an SSL certificate is present.

Do I need to act?

0.14% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.9/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Mahara

Affected Vendors

Mahara

References (6)

Third Party Advisory https://bugs.launchpad.net/mahara/+bug/1734767

Vendor Advisory https://mahara.org/interaction/forum/topic.php?id=8150

Vendor Advisory https://reviews.mahara.org/#/c/8312/

Third Party Advisory https://bugs.launchpad.net/mahara/+bug/1734767

Vendor Advisory https://mahara.org/interaction/forum/topic.php?id=8150

Vendor Advisory https://reviews.mahara.org/#/c/8312/

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal