Launchpad.net

CVE 2017-1000131

Mahara 15.04 before 15.04.8 and 15.10 before 15.10.4 and 16.04 before 16.04.2 are vulnerable to users staying logged in to their Mahara account even when they have been logged out of Moodle (when using MNet) as Mahara did not properly implement one of the MNet SSO API functions.

Related bugs and status

CVE-2017-1000131 (Candidate) is related to these bugs:

Bug #1084336: mnet: mahara doesn't implement kill_child which results in not being logged out when logged out from a remote IdP over mnet

		In	Importance	Status
1084336	mnet: mahara doesn't implement kill_child which results in not being logged out when logged out from a remote IdP over mnet	Mahara	Medium	Fix Released
1084336	mnet: mahara doesn't implement kill_child which results in not being logged out when logged out from a remote IdP over mnet	Mahara 15.10	Medium	Fix Released
1084336	mnet: mahara doesn't implement kill_child which results in not being logged out when logged out from a remote IdP over mnet	Mahara 15.04	Medium	Fix Released
1084336	mnet: mahara doesn't implement kill_child which results in not being logged out when logged out from a remote IdP over mnet	Mahara 16.04	Medium	Fix Released

See the

CVE page on Mitre.org for more details.

References

MISC: https://bugs.launchpad...