‹ Back to list

CVE-2014-1924

Status: ModifiedCritical (9.8)—
Severity9.8Critical · CVSS 3.1
Exploitation probability2.04 %higher than 81% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors.

CVSS

Base score
9.8
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
2.04 %
Percentile among all scored CVEs
81
Score date
10/21/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Koha — Koha

CWEs

References

Show 8 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2014-1924",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-24T17:15:12.327",
  "references": [
    {
      "url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://koha-community.org/security-release-february-2014/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/02/07/10",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/02/10/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=11666",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://koha-community.org/security-release-february-2014/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/02/07/10",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2014/02/10/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The MARC framework import/export function (admin/import_export_framework.pl) in Koha before 3.8.23, 3.10.x before 3.10.13, 3.12.x before 3.12.10, and 3.14.x before 3.14.3 does not require authentication, which allows remote attackers to conduct SQL injection attacks via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "La función MARC framework import/export (archivo admin/import_export_framework.pl) en Koha versiones anteriores a 3.8.23, versiones 3.10.x anteriores a 3.10.13, versiones 3.12.x anteriores a 3.12.10 y versiones 3.14.x anteriores a 3.14.3, no requiere autenticación, lo que permite a atacantes remotos llevar a cabo ataques de inyección SQL por medio de vectores no especificados."
    }
  ],
  "lastModified": "2026-06-17T00:05:45.570",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "217F4C5D-055C-43AA-983A-51CF9408B213",
              "versionEndExcluding": "3.08.23"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D66E4EE-C4FC-411F-957B-F21A618EBC7E",
              "versionEndExcluding": "3.10.13",
              "versionStartIncluding": "3.10.00"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "173A2792-F4A9-4378-9CA7-6FAE08D75492",
              "versionEndExcluding": "3.12.10",
              "versionStartIncluding": "3.12.00"
            },
            {
              "criteria": "cpe:2.3:a:koha:koha:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DE8FEB3-A97F-4F8C-A5FC-4B70E6E08859",
              "versionEndExcluding": "3.14.03",
              "versionStartIncluding": "3.14.00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}