NVD Vulnerability Detail

CVE-2011-4715

Summary	Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm.
Publication Date	Dec. 9, 2011, 4:55 a.m.
Registration Date	Jan. 28, 2021, 4:39 p.m.
Last Update	Nov. 21, 2024, 10:32 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:koha:liblime_koha::::::::			4.2

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:koha:koha:3.06.00.000:::::::*

Related information, measures and tools

No	URL	タグ
1	http://koha-community.org/koha-3-4-7/#more-2971
2	http://koha-community.org/koha-3-6-1/#more-2929
3	http://osvdb.org/77322
4	http://secunia.com/advisories/46980	Vendor Advisory
5	http://www.exploit-db.com/exploits/18153	Exploit
6	http://www.securityfocus.com/bid/50812	Exploit
7	http://www.vigasis.com/en/?guncel_guvenlik=LibLime%20Koha%20%3C=%204.2%20Local%20File%20Inclusion%20Vulnerability&lnk=exploits/18153	Exploit
8	https://exchange.xforce.ibmcloud.com/vulnerabilities/71478
9	https://github.com/liblime/LibLime-Koha/commit/8ea6f7bc37d05a9ec25b5afbea011cf9de5f1e49#C4/Output.pm
10	http://koha-community.org/koha-3-4-7/#more-2971
11	https://github.com/liblime/LibLime-Koha/commit/8ea6f7bc37d05a9ec25b5afbea011cf9de5f1e49#C4/Output.pm
12	https://exchange.xforce.ibmcloud.com/vulnerabilities/71478
13	http://www.vigasis.com/en/?guncel_guvenlik=LibLime%20Koha%20%3C=%204.2%20Local%20File%20Inclusion%20Vulnerability&lnk=exploits/18153	Exploit
14	http://www.securityfocus.com/bid/50812	Exploit
15	http://www.exploit-db.com/exploits/18153	Exploit
16	http://secunia.com/advisories/46980	Vendor Advisory
17	http://osvdb.org/77322
18	http://koha-community.org/koha-3-6-1/#more-2929

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-22	パス・トラバーサル	https://cwe.mitre.org/data/definitions/22.html

JVN Vulnerability Information

Koha および LibLime Koha におけるディレクトリトラバーサルの脆弱性

Title	Koha および LibLime Koha におけるディレクトリトラバーサルの脆弱性
Summary	Koha および LibLime Koha の cgi-bin/koha/mainpage.pl には、ディレクトリトラバーサルの脆弱性が存在します。
Possible impacts	第三者により、cgi-bin/opac/opac-main.pl の KohaOpacLanguage クッキーに含まれる .. (ドットドット) を介して、任意のファイルを読まれる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 25, 2011, midnight
Registration Date	Dec. 13, 2011, 3:05 p.m.
Last Update	Dec. 13, 2011, 3:05 p.m.

Affected System

Koha

Koha 3.4.7 未満の 3.4

Koha 3.6.1 未満の 3.6

LibLime Koha 4.2 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-4715	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4715
National Vulnerability Database (NVD)
2	CVE-2011-4715	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4715

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-22	https://jvndb.jvn.jp/ja/cwe/CWE-22.html

ベンダー情報

No	Name	URL
GitHub
1	[#21464023] Security: arbitrary file inclusion	https://github.com/liblime/LibLime-Koha/commit/8ea6f7bc37d05a9ec25b5afbea011cf9de5f1e49#C4/Output.pm
Koha
2	Koha 3.4.7	http://koha-community.org/koha-3-4-7/
3	Koha 3.6.1	http://koha-community.org/koha-3-6-1/

Change Log

No	Changed Details	Date of change
0	[2011年12月13日] 掲載	Feb. 17, 2018, 10:37 a.m.