CVE-2023-5894: XSS in Open Journal Systems
Platform
php
Component
ojs
Fixed in
3.3.0-16
CVE-2023-5894 describes a Cross-Site Scripting (XSS) vulnerability discovered in the Open Journal Systems (OJS) platform. This vulnerability allows an attacker to inject malicious scripts into the system, potentially leading to unauthorized access and data compromise. The vulnerability affects versions of OJS prior to 3.3.0-16, and a patch has been released to address the issue.
Impact and Attack Scenarios
The XSS vulnerability in OJS allows an attacker to inject arbitrary JavaScript code into web pages viewed by other users. This can be exploited to steal session cookies, redirect users to malicious websites, or deface the website. Successful exploitation could result in unauthorized access to user accounts, data breaches, and reputational damage. The stored nature of the XSS means the malicious script persists until removed, potentially affecting a large number of users over time.
Exploitation Context
CVE-2023-5894 was publicly disclosed on November 1, 2023. As of this writing, no public exploits have been reported, and it is not listed on the CISA KEV catalog. The LOW CVSS score indicates a relatively low probability of exploitation, but proactive patching is still recommended.
Threat Intelligence
Exploit Status
EPSS
0.07% (22% percentile)
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- High — admin or privileged account required to exploit.
- User Interaction
- Required — victim must take an action: open a file, click a link, or visit a crafted page.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- Low — partial or indirect data access. Attacker gains limited information.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2023-5894 is to upgrade to Open Journal Systems version 3.3.0-16 or later. If upgrading is not immediately feasible, consider implementing strict input validation and output encoding on all user-supplied data. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and sanitize user-generated content to prevent the injection of malicious scripts.
How to fix
Update Open Journal Systems to version 3.3.0-16 or higher. This version contains a fix for the stored XSS vulnerability. The update can be performed through the administration panel or by downloading the latest version of the software and replacing the files.
CVE Security Newsletter
Vulnerability analysis and critical alerts directly to your inbox.
Frequently asked questions
What is CVE-2023-5894 — Cross-Site Scripting in Open Journal Systems?
CVE-2023-5894 is a stored XSS vulnerability in Open Journal Systems (OJS) versions prior to 3.3.0-16, allowing attackers to inject malicious scripts.
Am I affected by CVE-2023-5894 in Open Journal Systems?
You are affected if you are running Open Journal Systems version 3.3.0-16 or earlier. Check your version and upgrade if necessary.
How do I fix CVE-2023-5894 in Open Journal Systems?
Upgrade to Open Journal Systems version 3.3.0-16 or later to resolve the vulnerability. Consider input validation and WAF rules as interim measures.
Is CVE-2023-5894 being actively exploited?
As of now, there are no confirmed reports of active exploitation, but proactive patching is still recommended.
Where can I find the official Open Journal Systems advisory for CVE-2023-5894?
Refer to the official Open Journal Systems security advisories on their website or GitHub repository for the latest information.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.