CVE-2011-4715 Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (...
MediumCVSS 5.0
EPSS 8.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| koha liblime koha | <= 4.2 | No fix listed |
| koha | = 3.06.00.000 | No fix listed |
| koha | = 3.04.00 | No fix listed |
| koha | = 3.04.01 | No fix listed |
| koha | = 3.04.02 | No fix listed |
| koha | = 3.04.03 | No fix listed |
| koha | = 3.04.04 | No fix listed |
| koha | = 3.04.05 | No fix listed |
| koha | = 3.04.06 | No fix listed |
References
- koha-community.org
- koha-community.org
- 77322 vdb-entry
- 46980 third-party-advisory vendor-advisory
- 18153 exploit
- 50812 exploit vdb-entry
- www.vigasis.com exploit
- liblimekoha-opacmain-file-include(71478) vdb-entry
- github.com