CVE-2023-47271 - PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image

Back Back to CVE browser

MEDIUM

PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image

Published Nov 5, 2023

5.3

MEDIUM

CVSS 3.1

EPSS 0.62%

Description

PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (4)

http://packetstormsecurity.com/files/176255/PKP-WAL-3.4.0-3-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2023/Dec/23
mailing-list
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-51401
Advisory
https://github.com/pkp/pkp-lib/issues/9464
Issue TrackingPatch

Link	Providers	Tags
http://packetstormsecurity.com/files/176255/PKP-WAL-3.4.0-3-Remote-Code-Execution.html
http://seclists.org/fulldisclosure/2023/Dec/23		mailing-list
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-51401		Advisory
https://github.com/pkp/pkp-lib/issues/9464		Issue TrackingPatch