PT-2024-31956 · Public Knowledge · Pkp-Lib

Abdelkhalek Beraoud + 1 · Published 2024-10-21 · Updated 2024-10-23 · CVE-2024-46326

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Public Knowledge Project pkp-lib versions 3.4.0-7 and earlier

Description The issue is related to an Open redirect vulnerability due to a lack of input sanitization in the logout function.

Recommendations For Public Knowledge Project pkp-lib versions 3.4.0-7 and earlier, consider updating to a newer version to mitigate the risk, however at the moment there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the logout function until a patch is available.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-46326

Affected Products

Pkp-Lib

References · 6

• 🔥 https://github.com/beraoudabdelkhalek/research/blob/main/CVEs/CVE-2024-46326/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-46326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-46326 · Security Note
• https://github.com/pkp/pkp-lib/issues/10478 · Note
• https://drive.google.com/file/d/1AVVw1aibDPBHakU8eTpCA6hna5Ecg2UJ/view · Note
• https://twitter.com/VulmonFeeds/status/1848637414207619322 · Twitter Post