CVE-2015-4631
Summary
| CVE | CVE-2015-4631 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-10-18 21:29:00 UTC |
| Updated | 2018-12-04 20:01:00 UTC |
| Description | Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Koha ILS 3.20.x CSRF / XSS / Traversal / SQL Injection ≈ Packet Storm | MISC | packetstormsecurity.com | Exploit, Third Party Advisory, VDB Entry |
| Full Disclosure: SBA Research Vulnerability Disclosure - Multiple Critical Vulnerabilities in Koha ILS | FULLDISC | seclists.org | Exploit, Mailing List, Third Party Advisory |
| 14423 – Multiple XSS and XSRF issues in Staff Client | CONFIRM | bugs.koha-community.org | Exploit, Issue Tracking |
| Koha 3.20.1 - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities - PHP webapps Exploit | EXPLOIT-DB | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| Security Release – Koha 3.20.1 | Official Website of Koha Library Software | CONFIRM | koha-community.org | Product, Release Notes, Vendor Advisory |
| 14418 – XSS Flaws in OPAC Interface | CONFIRM | bugs.koha-community.org | Exploit, Issue Tracking, Vendor Advisory |
| Security Release – Koha 3.18.8 | Official Website of Koha Library Software | CONFIRM | koha-community.org | Product, Release Notes, Vendor Advisory |
| Researchers of SBA Research found several critical security vulnerabilities in the Koha Library software via Combinatorial Testing | SBA Research | MISC | www.sba-research.org | Third Party Advisory |
| Security Release – Koha 3.16.12 | Official Website of Koha Library Software | CONFIRM | koha-community.org | Product, Release Notes, Vendor Advisory |
| Koha 3.14.16 released | Official Website of Koha Library Software | CONFIRM | koha-community.org | Product, Release Notes, Vendor Advisory |
| 14416 – Stored XSS flaw affects OPAC and Staff interface | CONFIRM | bugs.koha-community.org | Exploit, Issue Tracking, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.