Public Knowledge · Pkp Open Journals System · CVE-2022-24181
**Name of the Vulnerable Software and Affected Versions**
PKP Open Journals System versions 2.4.8 through 3.3
**Description**
The issue allows remote attackers to inject arbitrary code via the `X-Forwarded-Host` Header, enabling cross-site scripting (XSS) attacks. This is achieved through Host Header injection.
**Recommendations**
For versions 2.4.8 through 3.3, consider restricting access to the `X-Forwarded-Host` Header to minimize the risk of exploitation. As a temporary workaround, disabling the use of the `X-Forwarded-Host` Header until a patch is available can help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.