Lucene search

VulDBCVE-2018-25101

HistoryApr 22, 2024 - 2:15 a.m.

CVE-2018-25101

2024-04-2202:15:07

CWE-79

VulDB

web.nvd.nist.gov

cross site scripting

l2c2technologies koha

remote attackers manipulation

opac-marcdetail.pl

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

Percentile

15.5%

JSON

A vulnerability, which was classified as problematic, has been found in l2c2technologies Koha up to 20180108. This issue affects some unknown processing of the file /cgi-bin/koha/opac-MARCdetail.pl. The manipulation of the argument biblionumber with the input 2"><TEST> leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is 950fc8e101886821879066b33e389a47fb0a9782. It is recommended to upgrade the affected component. The identifier VDB-261677 was assigned to this vulnerability.

Affected configurations

Vulners

Node

l2c2technologieskohaMatch20180108

VendorProductVersionCPE
l2c2technologieskoha20180108cpe:2.3:a:l2c2technologies:koha:20180108:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
l2c2technologies	koha	20180108	cpe:2.3:a:l2c2technologies:koha:20180108:::::::*

CNA Affected

[
  {
    "vendor": "l2c2technologies",
    "product": "Koha",
    "versions": [
      {
        "version": "20180108",
        "status": "affected"
      }
    ]
  }
]

References

github.com/l2c2technologies/Koha/commit/950fc8e101886821879066b33e389a47fb0a9782

vuldb.com/?ctiid.261677

vuldb.com/?id.261677

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

3.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for CVE-2018-25101