CVE-2019-19909: Code Injection
An issue was discovered in Public Knowledge Project (PKP) pkp-lib before 3.1.2-2, as used in Open Journal Systems (OJS) before 3.1.2-2. Code injection can occur in the OJS report generator if an authenticated Journal Manager user visits a crafted URL, because unserialize is used.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19909?
The severity of CVE-2019-19909 is high.
How does CVE-2019-19909 impact Public Knowledge Project (PKP) pkp-lib?
CVE-2019-19909 allows code injection in the OJS report generator if an authenticated Journal Manager user visits a crafted URL.
What is the affected version of Open Journal Systems (OJS) in CVE-2019-19909?
The affected version of Open Journal Systems (OJS) is before 3.1.2-2.
How can code injection be prevented in Open Journal Systems (OJS) to mitigate CVE-2019-19909?
To mitigate CVE-2019-19909, it is recommended to update to version 3.1.2-2 or later of Public Knowledge Project (PKP) pkp-lib.
Where can I find more information about CVE-2019-19909?
More information about CVE-2019-19909 can be found at the following references: [1](https://github.com/pkp/pkp-lib/compare/3_1_2-1...3_1_2-2), [2](https://github.com/pkp/pkp-lib/issues/5302), [3](https://pkp.sfu.ca/ojs/ojs_download/).