CVE-2024-56525: Critical severity public knowledge project vulnerability
In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56525?
CVE-2024-56525 has been classified as a high severity vulnerability due to the potential for XXE attacks that can elevate privileges and compromise the journal system.
How do I fix CVE-2024-56525?
To fix CVE-2024-56525, upgrade Public Knowledge Project OJS, OMP, or OPS to version 3.3.0.22 or later, or 3.4.0.9 or later.
Who is affected by CVE-2024-56525?
CVE-2024-56525 affects users of Public Knowledge Project OJS, OMP, and OPS versions before 3.3.0.21 and 3.4.x before 3.4.0.8.
What type of attack does CVE-2024-56525 describe?
CVE-2024-56525 describes an XXE (XML External Entity) attack that can allow a Journal Editor to upload malicious XML to exploit the system.
What is the impact of exploiting CVE-2024-56525?
Exploiting CVE-2024-56525 can lead to unauthorized role creation as a super admin and installation of backdoor plugins in the journal context.