CVE-2024-25438: XSS
Published Mar 1, 2024
·Updated
A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function.
Affected Software
2 affected components
pkp Ojs
Public Knowledge Project Open Journal Systems=3.3.0-0
Event History
Mar 1, 2024
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·11:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-25438?
CVE-2024-25438 is classified as a high severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2024-25438?
To mitigate CVE-2024-25438, ensure input validation and sanitization is implemented for the 'Input subject' field in the Submission module.
3
Which software versions are affected by CVE-2024-25438?
CVE-2024-25438 affects Pkp Ojs version 3.3.0-0 and potentially other versions in the 3.3.x series.
4
What type of attack can be executed via CVE-2024-25438?
CVE-2024-25438 allows attackers to execute arbitrary web scripts or HTML through a crafted payload.
5
In which module is CVE-2024-25438 located?
CVE-2024-25438 is located in the Submission module of Pkp Ojs.