Описание
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times.
Ссылки
- Third Party Advisory
- ExploitThird Party Advisory
- Product
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 25.11.00 (включая)
cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*
EPSS
Процентиль: 16%
0.00243
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-918
Связанные уязвимости
CVSS3: 6.5
debian
3 месяца назад
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) ...
CVSS3: 6.5
github
3 месяца назад
An issue in Koha v.25.11 and before allows a remote attacker to execute arbitrary code via the Z39.50 configuration module
EPSS
Процентиль: 16%
0.00243
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-918