var-202001-1230
Vulnerability from variot

The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors. Koha In SQL An injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Koha is prone to the following security vulnerabilities: 1. An arbitrary file-access vulnerability 2. A directory-traversal vulnerability 3. An arbitrary file-write vulnerability 4. An SQL-injection vulnerability An attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, read or write arbitrary files from the web server, and potentially obtain sensitive information on the affected application. This may aid in further attacks

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202001-1230",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "koha",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "koha",
        "version": "3.08.23"
      },
      {
        "model": "koha",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "koha",
        "version": "3.12.10"
      },
      {
        "model": "koha",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "koha",
        "version": "3.10.00"
      },
      {
        "model": "koha",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "koha",
        "version": "3.14.00"
      },
      {
        "model": "koha",
        "scope": "gte",
        "trust": 1.0,
        "vendor": "koha",
        "version": "3.12.00"
      },
      {
        "model": "koha",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "koha",
        "version": "3.14.03"
      },
      {
        "model": "koha",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "koha",
        "version": "3.10.13"
      },
      {
        "model": "library software community koha",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "koha",
        "version": "3.8.22"
      },
      {
        "model": "library software community koha",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "koha",
        "version": "3.14.2"
      },
      {
        "model": "library software community koha",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "koha",
        "version": "3.12.9"
      },
      {
        "model": "library software community koha",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "koha",
        "version": "3.10.12"
      },
      {
        "model": "library software community koha",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "koha",
        "version": "3.8.23"
      },
      {
        "model": "library software community koha",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "koha",
        "version": "3.14.3"
      },
      {
        "model": "library software community koha",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "koha",
        "version": "3.12.10"
      },
      {
        "model": "library software community koha",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "koha",
        "version": "3.10.13"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "65448"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-1924"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Chris Cormack, Galen Charlton, and John Lightsey",
    "sources": [
      {
        "db": "BID",
        "id": "65448"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2014-1924",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2014-1924",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2014-1924",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 9.8,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2014-1924",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2014-1924",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "CVE-2014-1924",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202001-1090",
            "trust": 0.6,
            "value": "CRITICAL"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-1090"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-1924"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors. Koha In SQL An injection vulnerability exists.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Koha is prone to the following security vulnerabilities:\n1. An arbitrary file-access vulnerability\n2. A directory-traversal vulnerability\n3. An arbitrary file-write vulnerability\n4. An SQL-injection vulnerability\nAn attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, read or write arbitrary files from the web server, and potentially obtain sensitive  information on the affected application. This may aid in further  attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2014-1924"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "db": "BID",
        "id": "65448"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2014-1924",
        "trust": 2.7
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2014/02/07/10",
        "trust": 1.6
      },
      {
        "db": "OPENWALL",
        "id": "OSS-SECURITY/2014/02/10/3",
        "trust": 1.6
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-1090",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "65448",
        "trust": 0.3
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "65448"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-1090"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-1924"
      }
    ]
  },
  "id": "VAR-202001-1230",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.5804196
  },
  "last_update_date": "2024-11-23T22:16:39.958000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Bug\u00a011666 Koha",
        "trust": 0.8,
        "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666"
      },
      {
        "title": "Koha SQL Repair measures for injecting vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=112801"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-1090"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-89",
        "trust": 1.0
      },
      {
        "problemtype": "SQL injection (CWE-89) [NVD Evaluation ]",
        "trust": 0.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-1924"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.9,
        "url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666"
      },
      {
        "trust": 1.9,
        "url": "http://koha-community.org/security-release-february-2014/"
      },
      {
        "trust": 1.6,
        "url": "http://www.openwall.com/lists/oss-security/2014/02/07/10"
      },
      {
        "trust": 1.6,
        "url": "http://www.openwall.com/lists/oss-security/2014/02/10/3"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2014-1924"
      },
      {
        "trust": 0.3,
        "url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660"
      },
      {
        "trust": 0.3,
        "url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661"
      },
      {
        "trust": 0.3,
        "url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662"
      },
      {
        "trust": 0.3,
        "url": "http://koha-community.org/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "65448"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-1090"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-1924"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "65448"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-1090"
      },
      {
        "db": "NVD",
        "id": "CVE-2014-1924"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-02-07T00:00:00",
        "db": "BID",
        "id": "65448"
      },
      {
        "date": "2020-02-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "date": "2020-01-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202001-1090"
      },
      {
        "date": "2020-01-24T17:15:12.327000",
        "db": "NVD",
        "id": "CVE-2014-1924"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2014-02-07T00:00:00",
        "db": "BID",
        "id": "65448"
      },
      {
        "date": "2020-02-13T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      },
      {
        "date": "2021-01-04T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202001-1090"
      },
      {
        "date": "2024-11-21T02:05:17.070000",
        "db": "NVD",
        "id": "CVE-2014-1924"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "network",
    "sources": [
      {
        "db": "BID",
        "id": "65448"
      }
    ],
    "trust": 0.3
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Koha\u00a0 In \u00a0SQL\u00a0 Injection vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2014-008839"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SQL injection",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202001-1090"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.