CVE-2015-4630 Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to (1) hijack th...
HighCVSS 8.0
EPSS 3.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to (1) hijack the authentication of administrators for requests that create a user via a request to members/memberentry.pl or (2) give a user superlibrarian permission via a request to members/member-flags.pl or (3) hijack the authentication of arbitrary users for requests that conduct cross-site scripting (XSS) attacks via the addshelf parameter to opac-shelves.pl.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| koha | >= 3.14.00, < 3.14.16 | 3.14.16 |
| koha | >= 3.16.00, < 3.16.12 | 3.16.12 |
| koha | >= 3.18.0, < 3.18.8 | 3.18.8 |
| koha | >= 3.20.00, < 3.20.1 | 3.20.1 |
References
- bugs.koha-community.org exploit issue-tracking vendor-advisory
- koha-community.org product release-notes vendor-advisory
- koha-community.org product release-notes vendor-advisory
- koha-community.org product release-notes vendor-advisory
- koha-community.org product release-notes vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20150625 SBA Research Vulnerability Disclosure - Multiple Critical Vulnerabilities in Koha ILS exploit mailing-list third-party-advisory
- 37389 exploit third-party-advisory vdb-entry
- www.sba-research.org third-party-advisory