CVE-2017-1000237

Name of the Vulnerable Software and Affected Versions I, Librarian versions prior to 4.7

Description The issue allows for Server-Side Request Forgery in the ajaxsupplement.php file, enabling an attacker to reset any user's password.

Recommendations For versions prior to 4.7, consider restricting access to the ajaxsupplement.php file until a patch is available. As a temporary workaround, avoid using the password reset functionality in the affected versions to minimize the risk of exploitation.