CVE-2015-4631

Опубликовано: 18 окт. 2018

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) adds

Ссылки

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416
Exploit
Issue Tracking
Vendor Advisory
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14418
Exploit
Issue Tracking
Vendor Advisory
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423
Exploit
Issue Tracking
https://koha-community.org/koha-3-14-16-released/
Product
Release Notes
Vendor Advisory
https://koha-community.org/security-release-koha-3-16-12/
Product
Release Notes
Vendor Advisory
https://koha-community.org/security-release-koha-3-18-8/
Product
Release Notes
Vendor Advisory
https://koha-community.org/security-release-koha-3-20-1/
Product
Release Notes
Vendor Advisory
https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://seclists.org/fulldisclosure/2015/Jun/80
Exploit
Mailing List
Third Party Advisory
https://www.exploit-db.com/exploits/37389/
Exploit
Third Party Advisory
VDB Entry
https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/
Third Party Advisory
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416
Exploit
Issue Tracking
Vendor Advisory
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14418
Exploit
Issue Tracking
Vendor Advisory
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423
Exploit
Issue Tracking
https://koha-community.org/koha-3-14-16-released/
Product
Release Notes
Vendor Advisory
https://koha-community.org/security-release-koha-3-16-12/
Product
Release Notes
Vendor Advisory
https://koha-community.org/security-release-koha-3-18-8/
Product
Release Notes
Vendor Advisory
https://koha-community.org/security-release-koha-3-20-1/
Product
Release Notes
Vendor Advisory
https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://seclists.org/fulldisclosure/2015/Jun/80
Exploit
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*

Версия от 3.14.00 (включая) до 3.14.16 (исключая)

cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*

Версия от 3.16.00 (включая) до 3.16.12 (исключая)

cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*

Версия от 3.18.0 (включая) до 3.18.8 (исключая)

cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*

Версия от 3.20.00 (включая) до 3.20.1 (исключая)

EPSS

Процентиль: 66%

0.00532

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2015-4631

CVSS3: 5.4

debian

почти 7 лет назад

Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x bef ...

GHSA-24mg-jwcv-j892

CVSS3: 5.4

github

больше 3 лет назад

EPSS

Процентиль: 66%

0.00532

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79