CVE-2023-47271: Medium severity pkp web application library vulnerability
PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file named in an XML document (used for the native import/export plugin) is an image file, before trying to use it for an issue cover image.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-47271?
CVE-2023-47271 is a vulnerability in PKP-WAL (PKP Web Application Library) that allows an attacker to use a non-image file as an issue cover image.
How does CVE-2023-47271 impact Open Journal Systems (OJS) and other products that use PKP-WAL?
CVE-2023-47271 allows an attacker to import/export non-image files and potentially execute malicious code in OJS and other affected products.
What is the severity of CVE-2023-47271?
CVE-2023-47271 has a severity score of 5.3, which is considered medium.
How can I fix CVE-2023-47271?
To fix CVE-2023-47271, update PKP-WAL to version 3.3.0-16 or higher.
Where can I find more information about CVE-2023-47271?
You can find more information about CVE-2023-47271 on the GitHub page for PKP-WAL: https://github.com/pkp/pkp-lib/issues/9464