PT-2024-20369 · Unknown · Library Management System

Nitipoom Jaroonchaipipat · Published 2024-03-19 · Updated 2024-08-06 · CVE-2024-24336

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Koha Library Management System versions 23.05.05 and earlier

Description A multiple Cross-site scripting (XSS) vulnerability in the "/members/moremember.pl" and "/members/members-home.pl" endpoints allows malicious staff users to carry out CSRF attacks, including unauthorized changes to usernames and passwords of users visiting the affected page, via the Circulation note and Patrons Restriction components.

Recommendations For Koha Library Management System versions 23.05.05 and earlier, update to a version later than 23.05.05 to resolve the issue. As a temporary workaround, consider restricting access to the "/members/moremember.pl" and "/members/members-home.pl" endpoints until a patch is available. Avoid using the Circulation note and Patrons Restriction components in the affected endpoints until the issue is resolved.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-24336

Affected Products

Library Management System

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-24336 · Security Note
• https://twitter.com/VulmonFeeds/status/1770216151299035288 · Twitter Post
• https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-24336 · Note
• https://nitipoom-jar.github.io/CVE-2024-24336 · Note
• https://t.me/cvenotify/89493 · Telegram Post
• https://twitter.com/CVEnew/status/1770187992897819059 · Twitter Post