PT-2024-20430 · Public Knowledge · Pkp Ojs

Srivishnu P · Published 2024-03-01 · Updated 2024-08-06 · CVE-2024-24511

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PKP OJS version 3.4

Description The issue allows an attacker to execute arbitrary code via the Input Title component. This is a Cross Site Scripting vulnerability.

Recommendations For PKP OJS version 3.4, consider disabling the Input Title component until a patch is available to prevent exploitation. Restrict access to this component to minimize the risk of arbitrary code execution. Avoid using the Input Title component in sensitive areas of the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-24511

Affected Products

Pkp Ojs

References · 6

• 🔥 https://github.com/machisri/CVEs-and-Vulnerabilities/blob/main/CVE-2024-24511%20-%3E%20Stored%20XSS%20in%20input%20Title%20of%20the%20Component · Exploit
• https://osv.dev/vulnerability/CVE-2024-24511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24511 · Security Note
• https://t.me/cvenotify/72855 · Telegram Post
• https://drive.google.com/file/d/1IhU9tNhc6enKL1Dgq9--R05biJBjodKv/view?usp=sharing · Note
• https://twitter.com/VulmonFeeds/status/1763743933832544448 · Twitter Post