Vulnerability Description
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments as paid for certain users on behalf of Administrators. This attack appear to be exploitable via The victim must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 17.11.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Koha | Koha | >= 16.11.0, <= 16.11.13 |
Related Weaknesses (CWE)
References
- https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19117ExploitIssue TrackingPatch
- https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19117ExploitIssue TrackingPatch
FAQ
What is CVE-2018-1000669?
CVE-2018-1000669 is a vulnerability with a CVSS score of 8.8 (HIGH). KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters aff...
How severe is CVE-2018-1000669?
CVE-2018-1000669 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-1000669?
Check the references section above for vendor advisories and patch information. Affected products include: Koha Koha.