‹ Back to list

CVE-2014-1922

Status: ModifiedHigh (7.5)—
Severity7.5High · CVSS 3.1
Exploitation probability2.31 %higher than 83% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote attackers to read arbitrary files via unspecified vectors.

CVSS

Base score
7.5
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
2.31 %
Percentile among all scored CVEs
83
Score date
10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Koha — Koha

CWEs

References

Show 8 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-1922",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-24T17:15:12.173",
  "references": [
    {
      "url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://koha-community.org/security-release-february-2014/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/02/07/10",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/02/10/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11660",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://koha-community.org/security-release-february-2014/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/02/07/10",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/02/10/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Absolute path traversal vulnerability in tools/pdfViewer.pl in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 allows remote attackers to read arbitrary files via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de salto de ruta en el archivo tools/pdfViewer.pl en Koha versiones anteriores a 3.8.23, versiones 3.10.x anteriores a 3.10.13, versiones 3.12.x anteriores a 3.12.10 y versiones 3.14.x anteriores a 3.14.3, permite a atacantes remotos leer archivos arbitrarios por medio de vectores no especificados"
    }
  ],
  "lastModified": "2026-06-17T00:05:45.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "217F4C5D-055C-43AA-983A-51CF9408B213",
              "versionEndExcluding": "3.08.23"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D66E4EE-C4FC-411F-957B-F21A618EBC7E",
              "versionEndExcluding": "3.10.13",
              "versionStartIncluding": "3.10.00"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "173A2792-F4A9-4378-9CA7-6FAE08D75492",
              "versionEndExcluding": "3.12.10",
              "versionStartIncluding": "3.12.00"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DE8FEB3-A97F-4F8C-A5FC-4B70E6E08859",
              "versionEndExcluding": "3.14.03",
              "versionStartIncluding": "3.14.00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}