CVE-2018-1000669: CSRF
KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) contains a Cross Site Request Forgery (CSRF) vulnerability in /cgi-bin/koha/members/paycollect.pl Parameters affected: borrowernumber, amount, amountoutstanding, paid that can result in Attackers can mark payments as paid for certain users on behalf of Administrators. This attack appear to be exploitable via The victim must be socially engineered into clicking a link, usually via email. This vulnerability appears to have been fixed in 17.11.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the CVE ID for this vulnerability?
This vulnerability is identified by CVE-2018-1000669.
What is the severity rating of CVE-2018-1000669?
CVE-2018-1000669 has a severity rating of 8.8 (high).
What is the affected software version range for CVE-2018-1000669?
The affected software versions for CVE-2018-1000669 range from 16.11.0 to 16.11.13 and from 17.05.0 to 17.05.05.
What is the description of CVE-2018-1000669?
CVE-2018-1000669 is a Cross Site Request Forgery (CSRF) vulnerability in KOHA Library System version 16.11.x (up until 16.11.13) and 17.05.x (up until 17.05.05) that allows attackers to mark payments.
Are there any references available for CVE-2018-1000669?
Yes, you can find more information about CVE-2018-1000669 at https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=19117.