CVE-2015-4632

EPSS 51.8%

Vexday Risk Score

50Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 51.8%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

26 Jun 2015Public PoC

18 Oct 2018Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1) svc/virtualshelves/search or (2) svc/members/search.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.htmlunverified cve_referencewww.exploit-db.com/exploits/37388/unverified exploitdbwww.exploit-db.com/exploits/37388unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 https://koha-community.org/koha-3-14-16-released/https://koha-community.org/security-release-koha-3-16-12/https://koha-community.org/security-release-koha-3-18-8/https://koha-community.org/security-release-koha-3-20-1/https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html https://seclists.org/fulldisclosure/2015/Jun/80 https://www.exploit-db.com/exploits/37388/https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/