CVE-2018-12229: XSS
Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability identifier of this vulnerability?
The vulnerability identifier of this vulnerability is CVE-2018-12229.
What is the severity of CVE-2018-12229?
The severity of CVE-2018-12229 is medium with a CVSS score of 6.1.
What software is affected by CVE-2018-12229?
The Public Knowledge Project (PKP) Open Journal System (OJS) versions 3.0.0 to 3.1.1-1 are affected by CVE-2018-12229.
How can remote attackers exploit CVE-2018-12229?
Remote attackers can exploit CVE-2018-12229 by injecting arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).
Are there any fixes or patches available for CVE-2018-12229?
Yes, fixes for CVE-2018-12229 are available in the OJS 3.1.1-2 and OMP 3.1.1-3 releases. Please refer to the provided references for more information.