Lucene search

MitreCVE-2018-12229

HistoryJun 12, 2018 - 11:29 a.m.

CVE-2018-12229

2018-06-1211:29:00

CWE-79

mitre

web.nvd.nist.gov

cve

2018

12229

cross-site scripting

xss

vulnerability

public knowledge project

pkp

open journal system

ojs 3.0.0

3.1.1-1

remote attackers

web script

html

templates

frontend

pages

search.tpl

by author field

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

54.9%

JSON

Cross-site scripting (XSS) vulnerability in Public Knowledge Project (PKP) Open Journal System (OJS) 3.0.0 to 3.1.1-1 allows remote attackers to inject arbitrary web script or HTML via the templates/frontend/pages/search.tpl parameter (aka the By Author field).

Affected configurations

Nvd

Node

sfuopen_journal_systemRange3.0.0–3.1.1-1

VendorProductVersionCPE
sfuopen_journal_system*cpe:2.3:a:sfu:open_journal_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
sfu	open_journal_system	*	cpe:2.3:a:sfu:open_journal_system::::::::

References

forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937

forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938

github.com/pkp/pkp-lib/issues/3785

metamorfosec.com/Files/Advisories/METS-2018-001-A_XSS_Vulnerability_in_OJS_3.0.0_to_3.1.1-1.txt

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.002

Percentile

54.9%

JSON

Related for CVE-2018-12229