PT-2024-10620 · L2C2Technologies · Koha

L2C2Technologies · Published 2024-04-22 · Updated 2024-06-04 · CVE-2018-25101

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions l2c2technologies Koha versions up to 20180108

Description A problematic issue has been found in the processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the biblionumber argument with a malicious input, such as 2"><TEST>, leads to cross-site scripting. This issue can be exploited remotely.

Recommendations For versions up to 20180108, it is recommended to upgrade the affected component to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the /cgi-bin/koha/opac-MARCdetail.pl endpoint or avoiding the use of the biblionumber argument until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-25101

Affected Products

Koha

References · 5

• https://github.com/l2c2technologies/Koha/commit/950fc8e101886821879066b33e389a47fb0a9782 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-25101 · Security Note
• https://osv.dev/vulnerability/CVE-2018-25101 · Vendor Advisory
• https://vuldb.com/?ctiid.261677 · Note
• https://vuldb.com/?id.261677 · Note