PT-2015-4209 · Bywater Solutions · Koha

Publicado 2015-01-02 · Atualizado 2015-01-06 · CVE-2014-9446

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Koha versions prior to 3.16.6 Koha versions 3.18.x prior to 3.18.2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the sort by parameter to the (1) opac parameter in "opac-search.pl" or (2) intranet parameter in "catalogue/search.pl".

Recommendations For Koha versions prior to 3.16.6, update to version 3.16.6 or later. For Koha versions 3.18.x prior to 3.18.2, update to version 3.18.2 or later. As a temporary workaround, consider restricting access to the sort by parameter in the affected API endpoints until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2014-9446

Produtos afetados

Koha

Referências · 7

• 🔥 http://securityfocus.com/bid/71803 · Exploit
• http://koha-community.org/koha-3-16-6-release · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-9446 · Nota de Segurança
• http://secunia.com/advisories/61187 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9446 · Nota
• http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425 · Nota
• http://koha-community.org/koha-3-18-2-release · Aviso do Fabricante