CVE-2012-1469: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tinymce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1469?
CVE-2012-1469 is considered a medium-severity vulnerability due to its ability to allow remote attackers to perform cross-site scripting.
How do I fix CVE-2012-1469?
To fix CVE-2012-1469, upgrade Open Journal Systems to version 2.3.7 or later.
Who is affected by CVE-2012-1469?
Any user of Open Journal Systems versions prior to 2.3.7 is potentially affected by CVE-2012-1469.
What are the consequences of exploiting CVE-2012-1469?
Exploiting CVE-2012-1469 could allow attackers to inject and execute arbitrary web scripts or HTML, potentially compromising user data.
Can CVE-2012-1469 be exploited without authentication?
Yes, CVE-2012-1469 can be exploited by both unauthenticated remote attackers and authenticated users, increasing its risk profile.