CVE-2014-1924

EUVD-2014-1985
The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 88%
Affected Products (NVD)
VendorProductVersion
kohakoha
𝑥
< 3.08.23
kohakoha
3.10.00 ≤
𝑥
< 3.10.13
kohakoha
3.12.00 ≤
𝑥
< 3.12.10
kohakoha
3.14.00 ≤
𝑥
< 3.14.03
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666
http://koha-community.org/security-release-february-2014/
http://www.openwall.com/lists/oss-security/2014/02/07/10
http://www.openwall.com/lists/oss-security/2014/02/10/3
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666
http://koha-community.org/security-release-february-2014/
http://www.openwall.com/lists/oss-security/2014/02/07/10
http://www.openwall.com/lists/oss-security/2014/02/10/3