Security readout for executives and security teams
Plain-English summary
I, Librarian versions 4.7 and earlier are reported to have reflected cross-site scripting in temp.php. A malicious link could cause script to run in a user’s browser when they visit a manipulated site. Business impact depends on who uses the application and whether authenticated sessions or sensitive library data are exposed.
Executive priority
Treat as a targeted application security issue, not an emergency based on current evidence. Prioritize remediation if the system is internet-facing, used by privileged staff, or contains sensitive records.
Technical view
The CVE describes reflected XSS in I, Librarian temp.php for versions <=4.6 and 4.7. The provided sources do not include CVSS, CWE, proof of active exploitation, or confirmed patch details. Reflected XSS generally requires user interaction and can affect the victim browser session.
Likely exposure
Exposure is limited to organizations running I, Librarian 4.7 or earlier with temp.php reachable by users. Internet exposure, shared workstations, administrator use, and sensitive authenticated sessions increase risk.
Exploitation context
The source states an attacker can inject client-side script that executes if users visit a manipulated site. CISA KEV is false, and the provided sources do not report active exploitation.
Researcher notes
Evidence is sparse: the bundle provides the CVE description and SEC Consult advisory reference, but no CVSS, CWE, patch version, or exploitation telemetry. Avoid assuming products beyond I, Librarian or affected versions beyond those stated.
Mitigation direction
- Inventory I, Librarian deployments and confirm versions.
- Check vendor or maintainer guidance for a fixed release or workaround.
- Restrict access to I, Librarian until remediation is confirmed.
- Avoid exposing affected instances directly to the internet.
- Review session and browser security controls for affected users.
Validation and detection
- Identify whether I, Librarian 4.7 or earlier is deployed.
- Confirm whether temp.php is present and reachable.
- Review web logs for unusual requests to temp.php.
- Use authorized benign XSS scanning to validate remediation only.
- Document vendor guidance and applied remediation status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-1000236 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170509-0_I_Librarian_Multiple_vulnerabilities_v10.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.