Cross Site Request Forgery Vulnerability in KOHA Library System by ByWater Solutions
CVE-2018-1000669

8.8HIGH

Key Information:

Vendor
Koha
Status
Koha
Vendor
CVE Published:
6 September 2018

Summary

A Cross Site Request Forgery (CSRF) vulnerability exists in the KOHA Library System, affecting versions 16.11.x up to 16.11.13 and 17.05.x up to 17.05.05. This vulnerability allows attackers to manipulate payment statuses on behalf of administrators, potentially leading to unauthorized payment confirmations for certain users. Exploitation requires the victim to be deceived into clicking a malicious link, typically delivered through email. The issue has been addressed in version 17.11 of the KOHA Library System.

References

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.