CVE-2018-1000669

KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments as paid for certain users on behalf of Administrators. This attack appear to be exploitable via The victim must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 17.11.

CVSS v3 8.8 HIGH
CVSS v2.0 6.8 MEDIUM

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19117	Exploit Issue Tracking Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:koha:koha::::::::
	cpe:2.3:a:koha:koha::::::::

History

No history.

Information

Published : 2018-09-06 19:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-1000669

Mitre link : CVE-2018-1000669

CVE.ORG link : CVE-2018-1000669

JSON object : View

Products Affected

koha

koha

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2018-1000669", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2018-09-06T19:29:00.503", "references": [{"url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19117", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments as paid for certain users on behalf of Administrators. This attack appear to be exploitable via The victim must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 17.11."}, {"lang": "es", "value": "KOHA Library System en versiones 16.11.x (hasta la 16.11.13) y versiones 17.05.x (hasta la 17.05.05) contiene una vulnerabilidad Cross Site Request Forgery (CSRF) en /cgi-bin/koha/members/paycollect.pl. Los par\u00e1metros afectados son: borrowernumber, amount, amountoutstanding y paid. Esto puede resultar en que los atacantes puedan marcar pagos como \"pagados\" para ciertos usuarios en nombre de los administradores. El ataque parece ser explotable si la v\u00edctima es enga\u00f1ada mediante ingenier\u00eda social para que haga clic en un enlace, normalmente por email. La vulnerabilidad parece haber sido solucionada en la versi\u00f3n 17.11."}], "lastModified": "2018-11-07T19:04:19.930", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3248F696-8686-4093-94DE-2D30EBE76239", "versionEndIncluding": "16.11.13", "versionStartIncluding": "16.11.0"}, {"criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "20CF4C18-0421-40BA-BAFD-712040BE657A", "versionEndIncluding": "17.05.05", "versionStartIncluding": "17.05.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}