Shodan
Vulnerabilities
Vulnerable Software

Vulnerability Details CVE-2018-1000670

KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Scripting (XSS) vulnerability in Multiple fields on multiple pages including /cgi-bin/koha/acqui/supplier.pl?op=enter , /cgi-bin/koha/circ/circulation.pl?borrowernumber=[number] , /cgi-bin/koha/serials/subscription-add.pl that can result in Privilege escalation by taking control of higher privileged users browser sessions. This attack appear to be exploitable via Victims must be socially engineered to visit a vulnerable webpage containing malicious payload. This vulnerability appears to have been fixed in 17.11.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 51.3%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
Products affected by CVE-2018-1000670
  • Koha » Koha » Version: 16.11.0
    cpe:2.3:a:koha:koha:16.11.0
  • Koha » Koha » Version: 16.11.00
    cpe:2.3:a:koha:koha:16.11.00
  • Koha » Koha » Version: 16.11.01
    cpe:2.3:a:koha:koha:16.11.01
  • Koha » Koha » Version: 16.11.02
    cpe:2.3:a:koha:koha:16.11.02
  • Koha » Koha » Version: 16.11.03
    cpe:2.3:a:koha:koha:16.11.03
  • Koha » Koha » Version: 16.11.04
    cpe:2.3:a:koha:koha:16.11.04
  • Koha » Koha » Version: 16.11.05
    cpe:2.3:a:koha:koha:16.11.05
  • Koha » Koha » Version: 16.11.06
    cpe:2.3:a:koha:koha:16.11.06
  • Koha » Koha » Version: 16.11.07
    cpe:2.3:a:koha:koha:16.11.07
  • Koha » Koha » Version: 16.11.08
    cpe:2.3:a:koha:koha:16.11.08
  • Koha » Koha » Version: 16.11.09
    cpe:2.3:a:koha:koha:16.11.09
  • Koha » Koha » Version: 16.11.10
    cpe:2.3:a:koha:koha:16.11.10
  • Koha » Koha » Version: 16.11.11
    cpe:2.3:a:koha:koha:16.11.11
  • Koha » Koha » Version: 16.11.11-1
    cpe:2.3:a:koha:koha:16.11.11-1
  • Koha » Koha » Version: 16.11.12
    cpe:2.3:a:koha:koha:16.11.12
  • Koha » Koha » Version: 16.11.13
    cpe:2.3:a:koha:koha:16.11.13
  • Koha » Koha » Version: 17.05.0
    cpe:2.3:a:koha:koha:17.05.0
  • Koha » Koha » Version: 17.05.00
    cpe:2.3:a:koha:koha:17.05.00
  • Koha » Koha » Version: 17.05.01
    cpe:2.3:a:koha:koha:17.05.01
  • Koha » Koha » Version: 17.05.02
    cpe:2.3:a:koha:koha:17.05.02
  • Koha » Koha » Version: 17.05.03
    cpe:2.3:a:koha:koha:17.05.03
  • Koha » Koha » Version: 17.05.04
    cpe:2.3:a:koha:koha:17.05.04
  • Koha » Koha » Version: 17.05.05
    cpe:2.3:a:koha:koha:17.05.05


Products
Pricing
Contact Us

Shodan ® - All rights reserved