‹ Volver al listado

CVE-2015-4631

Estado: ModificadaMedia (5.4)—Exploit
Gravedad5.4Media · CVSS 3.0
Probabilidad de explotación3.71 %mayor que el 90 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoDisponiblePublicado en Exploit-DB

Múltiples vulnerabilidades Cross-Site Scripting (XSS) en Koha, en versiones 3.14.x anteriores a la 3.14.16, versiones 3.16.x anteriores a la 3.16.12, versiones 3.18.x anteriores a la 3.18.08 y versiones 3.20.x anteriores a la 3.20.1, permiten que atacantes remotos inyecten scripts web o HTML arbitrarios mediante (1) el parámetro tag en opac-search.pl; (2) el parámetro value en authorities/authorities-home.pl; (3) el parámetro delay en acqui/lateorders.pl; (4) los parámetros authtypecode o (5) tagfield en admin/auth_subfields_structure.pl; (6) el parámetro tagfield en admin/marc_subfields_structure.pl; (7) el parámetro limit en catalogue/search.pl; (8) los parámetros bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter o (13) title_filter en serials/serials-search.pl; o (14) los parámetros author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from o (22) suggesteddate_to en suggestion/suggestion.pl o los parámetros (23) direction, (24) display o (25) addshelf en opac-shelves.pl.

CVSS

Puntuación base
5.4
Versión
3.0
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
3.71 %
Percentil entre todas las CVEs puntuadas
90
Fecha de la puntuación
21/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Koha — Koha

CWE

Referencias

Mostrar las 22 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-4631",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-10-18T21:29:00.723",
  "references": [
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14418",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://koha-community.org/koha-3-14-16-released/",
      "tags": [
        "Product",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://koha-community.org/security-release-koha-3-16-12/",
      "tags": [
        "Product",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://koha-community.org/security-release-koha-3-18-8/",
      "tags": [
        "Product",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://koha-community.org/security-release-koha-3-20-1/",
      "tags": [
        "Product",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://seclists.org/fulldisclosure/2015/Jun/80",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.exploit-db.com/exploits/37389/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14418",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://koha-community.org/koha-3-14-16-released/",
      "tags": [
        "Product",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://koha-community.org/security-release-koha-3-16-12/",
      "tags": [
        "Product",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://koha-community.org/security-release-koha-3-18-8/",
      "tags": [
        "Product",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://koha-community.org/security-release-koha-3-20-1/",
      "tags": [
        "Product",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://seclists.org/fulldisclosure/2015/Jun/80",
      "tags": [
        "Exploit",
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/37389/",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades Cross-Site Scripting (XSS) en Koha, en versiones 3.14.x anteriores a la 3.14.16, versiones 3.16.x anteriores a la 3.16.12, versiones 3.18.x anteriores a la 3.18.08 y versiones 3.20.x anteriores a la 3.20.1, permiten que atacantes remotos inyecten scripts web o HTML arbitrarios mediante (1) el parámetro tag en opac-search.pl; (2) el parámetro value en authorities/authorities-home.pl; (3) el parámetro delay en acqui/lateorders.pl; (4) los parámetros authtypecode o (5) tagfield en admin/auth_subfields_structure.pl; (6) el parámetro tagfield en admin/marc_subfields_structure.pl; (7) el parámetro limit en catalogue/search.pl; (8) los parámetros bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter o (13) title_filter en serials/serials-search.pl; o (14) los parámetros author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from o (22) suggesteddate_to en suggestion/suggestion.pl o los parámetros (23) direction, (24) display o (25) addshelf en opac-shelves.pl."
    }
  ],
  "lastModified": "2026-06-17T00:27:38.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "214E9AA7-580C-4028-AB21-0D723D3037FD",
              "versionEndExcluding": "3.14.16",
              "versionStartIncluding": "3.14.00"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEBF9831-C8D6-4503-8192-13D04FB057DB",
              "versionEndExcluding": "3.16.12",
              "versionStartIncluding": "3.16.00"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A50154EE-37E5-4872-8A1C-57AA8132E91B",
              "versionEndExcluding": "3.18.8",
              "versionStartIncluding": "3.18.0"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AE6E0A0A-BA1C-4F6B-92E0-796FFD77AF41",
              "versionEndExcluding": "3.20.1",
              "versionStartIncluding": "3.20.00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}