PT-2023-30402 · Pkp-Wal · Pkp-Wal

Egidio Romano · Published 2023-11-05 · Updated 2023-12-20 · CVE-2023-47271

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PKP-WAL versions prior to 3.3.0-16 PKP-WAL versions prior to 3.4.0-3

Description The issue arises from the failure to verify that a file named in an XML document, used for the native import/export plugin, is an image file before attempting to use it for an issue cover image. This can lead to remote code execution.

Recommendations For versions prior to 3.3.0-16, update to version 3.3.0-16 or later. For versions prior to 3.4.0-3, update to version 3.4.0-3 or later. As a temporary workaround, consider disabling the native import/export plugin until a patch is available. Restrict access to the XML import functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2023-47271

Affected Products

Pkp-Wal

References · 10

• https://github.com/pkp/pkp-lib/issues/9464 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-47271 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47271 · Vendor Advisory
• https://t.me/rnetsec/19728 · Telegram Post
• https://t.me/defcon_news/120550 · Telegram Post
• https://t.me/cvenotify/63772 · Telegram Post
• http://seclists.org/fulldisclosure/2023/Dec/23 · Note
• https://twitter.com/fletch_ai/status/1737716281963405493 · Twitter Post
• https://t.me/cvenotify/64305 · Telegram Post
• http://packetstormsecurity.com/files/176255/PKP-WAL-3.4.0-3-Remote-Code-Execution.html · Note