CVE-2015-4631: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/authsubfieldsstructure.pl; the (6) tagfield parameter to admin/marcsubfieldsstructure.pl; the (7) limit parameter to catalogue/search.pl; the (8) booksellerfilter, (9) callnumberfilter, (10) EANfilter, (11) ISSNfilter, (12) publisherfilter, or (13) titlefilter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddatefrom, (19) manageddateto, (20) publishercode, (21) suggesteddatefrom, or (22) suggesteddateto parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2015-4631?
CVE-2015-4631 is a vulnerability that allows remote attackers to inject arbitrary web script or HTML in Koha versions 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1.
What is the severity of CVE-2015-4631?
The severity of CVE-2015-4631 is medium with a score of 5.4.
How can remote attackers exploit CVE-2015-4631?
Remote attackers can exploit CVE-2015-4631 by injecting arbitrary web script or HTML through the 'tag' parameter to opac-search.pl or the 'value' parameter to authorities/.
Which software versions are affected by CVE-2015-4631?
Koha versions 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 are affected by CVE-2015-4631.
Are there any references for CVE-2015-4631?
Yes, you can find references for CVE-2015-4631 at the following links: [1](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416), [2](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14418), [3](https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423).