PT-2015-4209 · Bywater Solutions · Koha

Published 2015-01-02 · Updated 2015-01-06 · CVE-2014-9446

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Koha versions prior to 3.16.6 Koha versions 3.18.x prior to 3.18.2

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the sort by parameter to the (1) opac parameter in "opac-search.pl" or (2) intranet parameter in "catalogue/search.pl".

Recommendations For Koha versions prior to 3.16.6, update to version 3.16.6 or later. For Koha versions 3.18.x prior to 3.18.2, update to version 3.18.2 or later. As a temporary workaround, consider restricting access to the sort by parameter in the affected API endpoints until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-9446

Affected Products

Koha

References · 7

• 🔥 http://securityfocus.com/bid/71803 · Exploit
• http://koha-community.org/koha-3-16-6-release · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9446 · Security Note
• http://koha-community.org/koha-3-18-2-release · Vendor Advisory
• http://secunia.com/advisories/61187 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9446 · Note
• http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=13425 · Note