CVEvulnerability
CVE-2014-1924
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-01-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-89
Description
The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.
Affected configurations
• koha koha (< 3.08.23)
• koha koha (>= 3.10.00 < 3.10.13)
• koha koha (>= 3.12.00 < 3.12.10)
• koha koha (>= 3.14.00 < 3.14.03)
Related
Weakness · CWE (1)
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness
References
- http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666 Exploit, Issue Tracking, Vendor Advisory
- http://koha-community.org/security-release-february-2014/ Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/02/07/10 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/02/10/3 Mailing List, Third Party Advisory
- http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666 Exploit, Issue Tracking, Vendor Advisory
- http://koha-community.org/security-release-february-2014/ Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/02/07/10 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/02/10/3 Mailing List, Third Party Advisory