CVE-2014-1923

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-1923
Multiple directory traversal vulnerabilities in the (1) staff interface help editor (edithelp.pl) or (2) member-picupload.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allow remote attackers to write to arbitrary files via unspecified vectors.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661 Issue Tracking Vendor Advisory
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662 Exploit Issue Tracking Vendor Advisory
http://koha-community.org/security-release-february-2014/ Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/02/07/10 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/02/10/3 Mailing List Third Party Advisory
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661 Issue Tracking Vendor Advisory
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662 Exploit Issue Tracking Vendor Advisory
http://koha-community.org/security-release-february-2014/ Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/02/07/10 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/02/10/3 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*
cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*
History

21 Nov 2024, 02:05

Type Values Removed Values Added
References () http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661 - Issue Tracking, Vendor Advisory () http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11661 - Issue Tracking, Vendor Advisory
References () http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662 - Exploit, Issue Tracking, Vendor Advisory () http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11662 - Exploit, Issue Tracking, Vendor Advisory
References () http://koha-community.org/security-release-february-2014/ - Vendor Advisory () http://koha-community.org/security-release-february-2014/ - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2014/02/07/10 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2014/02/07/10 - Mailing List, Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2014/02/10/3 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2014/02/10/3 - Mailing List, Third Party Advisory
Information

Published : 2020-01-24 17:15

Updated : 2024-11-21 02:05

NVD link : CVE-2014-1923

Mitre link : CVE-2014-1923

CVE.ORG link : CVE-2014-1923

JSON object : View

Products Affected

koha

  • koha
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')