What’s Vulnerable › Vulnerabilities

CVE-2015-4631

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-10-18 · updated 2026-06-17
• Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to inject arbitrary web script or HTML via the (1) tag parameter to opac-search.pl; the (2) value parameter to authorities/authorities-home.pl; the (3) delay parameter to acqui/lateorders.pl; the (4) authtypecode or (5) tagfield to admin/auth_subfields_structure.pl; the (6) tagfield parameter to admin/marc_subfields_structure.pl; the (7) limit parameter to catalogue/search.pl; the (8) bookseller_filter, (9) callnumber_filter, (10) EAN_filter, (11) ISSN_filter, (12) publisher_filter, or (13) title_filter parameter to serials/serials-search.pl; or the (14) author, (15) collectiontitle, (16) copyrightdate, (17) isbn, (18) manageddate_from, (19) manageddate_to, (20) publishercode, (21) suggesteddate_from, or (22) suggesteddate_to parameter to suggestion/suggestion.pl; or the (23) direction, (24) display or (25) addshelf parameter to opac-shelves.pl.

Affected products

• Koha Community Koha: from 3.14.00 before 3.14.16; from 3.16.00 before 3.16.12; from 3.18.0 before 3.18.8; from 3.20.00 before 3.20.1 — fixed in 3.14.16, 3.16.12, 3.18.8, 3.20.1

How to fix

Upgrade to a fixed version: Koha Community Koha 3.14.16, 3.16.12, 3.18.8, 3.20.1. Check the vendor advisory for mitigations.

References

• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416
• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14418
• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14423
• https://koha-community.org/koha-3-14-16-released/
• https://koha-community.org/security-release-koha-3-16-12/
• https://koha-community.org/security-release-koha-3-18-8/
• https://koha-community.org/security-release-koha-3-20-1/
• https://packetstormsecurity.com/files/132458/Koha-ILS-3.20.x-CSRF-XSS-Traversal-SQL-Injection.html
• https://seclists.org/fulldisclosure/2015/Jun/80
• https://www.exploit-db.com/exploits/37389/
• https://www.sba-research.org/2015/06/24/researchers-of-sba-research-found-several-critical-security-vulnerabilities-in-the-koha-library-software-via-combinatorial-testing/
• https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14416

Get alerted when CVE-2015-4631 or the next vulnerability affects your stack