VAR-202001-1230
Vulnerability from variot - Updated: 2023-12-18 12:35The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors. Koha In SQL An injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Koha is prone to the following security vulnerabilities: 1. An arbitrary file-access vulnerability 2. A directory-traversal vulnerability 3. An arbitrary file-write vulnerability 4. An SQL-injection vulnerability An attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, read or write arbitrary files from the web server, and potentially obtain sensitive information on the affected application. This may aid in further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-1230",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "koha",
"scope": "gte",
"trust": 1.0,
"vendor": "koha",
"version": "3.10.00"
},
{
"model": "koha",
"scope": "lt",
"trust": 1.0,
"vendor": "koha",
"version": "3.12.10"
},
{
"model": "koha",
"scope": "lt",
"trust": 1.0,
"vendor": "koha",
"version": "3.14.03"
},
{
"model": "koha",
"scope": "lt",
"trust": 1.0,
"vendor": "koha",
"version": "3.08.23"
},
{
"model": "koha",
"scope": "lt",
"trust": 1.0,
"vendor": "koha",
"version": "3.10.13"
},
{
"model": "koha",
"scope": "gte",
"trust": 1.0,
"vendor": "koha",
"version": "3.14.00"
},
{
"model": "koha",
"scope": "gte",
"trust": 1.0,
"vendor": "koha",
"version": "3.12.00"
},
{
"model": "library software community koha",
"scope": "eq",
"trust": 0.3,
"vendor": "koha",
"version": "3.8.22"
},
{
"model": "library software community koha",
"scope": "eq",
"trust": 0.3,
"vendor": "koha",
"version": "3.14.2"
},
{
"model": "library software community koha",
"scope": "eq",
"trust": 0.3,
"vendor": "koha",
"version": "3.12.9"
},
{
"model": "library software community koha",
"scope": "eq",
"trust": 0.3,
"vendor": "koha",
"version": "3.10.12"
},
{
"model": "library software community koha",
"scope": "ne",
"trust": 0.3,
"vendor": "koha",
"version": "3.8.23"
},
{
"model": "library software community koha",
"scope": "ne",
"trust": 0.3,
"vendor": "koha",
"version": "3.14.3"
},
{
"model": "library software community koha",
"scope": "ne",
"trust": 0.3,
"vendor": "koha",
"version": "3.12.10"
},
{
"model": "library software community koha",
"scope": "ne",
"trust": 0.3,
"vendor": "koha",
"version": "3.10.13"
}
],
"sources": [
{
"db": "BID",
"id": "65448"
},
{
"db": "NVD",
"id": "CVE-2014-1924"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.08.23",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.10.13",
"versionStartIncluding": "3.10.00",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.12.10",
"versionStartIncluding": "3.12.00",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "3.14.03",
"versionStartIncluding": "3.14.00",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1924"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Chris Cormack, Galen Charlton, and John Lightsey",
"sources": [
{
"db": "BID",
"id": "65448"
}
],
"trust": 0.3
},
"cve": "CVE-2014-1924",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2014-1924",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2014-1924",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-1924",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-202001-1090",
"trust": 0.6,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"db": "NVD",
"id": "CVE-2014-1924"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1090"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors. Koha In SQL An injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Koha is prone to the following security vulnerabilities:\n1. An arbitrary file-access vulnerability\n2. A directory-traversal vulnerability\n3. An arbitrary file-write vulnerability\n4. An SQL-injection vulnerability\nAn attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, read or write arbitrary files from the web server, and potentially obtain sensitive information on the affected application. This may aid in further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1924"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"db": "BID",
"id": "65448"
}
],
"trust": 1.89
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2014-1924",
"trust": 2.7
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2014/02/07/10",
"trust": 1.6
},
{
"db": "OPENWALL",
"id": "OSS-SECURITY/2014/02/10/3",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008839",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1090",
"trust": 0.6
},
{
"db": "BID",
"id": "65448",
"trust": 0.3
}
],
"sources": [
{
"db": "BID",
"id": "65448"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"db": "NVD",
"id": "CVE-2014-1924"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1090"
}
]
},
"id": "VAR-202001-1230",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.5804196
},
"last_update_date": "2023-12-18T12:35:47.668000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Bug\u00a011666 Koha",
"trust": 0.8,
"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666"
},
{
"title": "Koha SQL Repair measures for injecting vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=112801"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1090"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-89",
"trust": 1.0
},
{
"problemtype": "SQL injection (CWE-89) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"db": "NVD",
"id": "CVE-2014-1924"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.9,
"url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666"
},
{
"trust": 1.9,
"url": "http://koha-community.org/security-release-february-2014/"
},
{
"trust": 1.6,
"url": "http://www.openwall.com/lists/oss-security/2014/02/07/10"
},
{
"trust": 1.6,
"url": "http://www.openwall.com/lists/oss-security/2014/02/10/3"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1924"
},
{
"trust": 0.3,
"url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660"
},
{
"trust": 0.3,
"url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661"
},
{
"trust": 0.3,
"url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662"
},
{
"trust": 0.3,
"url": "http://koha-community.org/"
}
],
"sources": [
{
"db": "BID",
"id": "65448"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"db": "NVD",
"id": "CVE-2014-1924"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1090"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "BID",
"id": "65448"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"db": "NVD",
"id": "CVE-2014-1924"
},
{
"db": "CNNVD",
"id": "CNNVD-202001-1090"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-02-07T00:00:00",
"db": "BID",
"id": "65448"
},
{
"date": "2020-02-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"date": "2020-01-24T17:15:12.327000",
"db": "NVD",
"id": "CVE-2014-1924"
},
{
"date": "2020-01-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202001-1090"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-02-07T00:00:00",
"db": "BID",
"id": "65448"
},
{
"date": "2020-02-13T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-008839"
},
{
"date": "2020-01-30T20:33:08.307000",
"db": "NVD",
"id": "CVE-2014-1924"
},
{
"date": "2021-01-04T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202001-1090"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "65448"
}
],
"trust": 0.3
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Koha\u00a0 In \u00a0SQL\u00a0 Injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-008839"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SQL injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202001-1090"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…