CVE-2023-5904: XSS in pkp-lib Open Journal Systems

The primary impact of CVE-2023-5904 is the potential for Cross-Site Scripting (XSS) attacks. An attacker could inject malicious JavaScript code into the pkp-lib application, which would then be executed in the browsers of unsuspecting users. This could lead to various consequences, including session hijacking, redirection to malicious websites, and the theft of sensitive user data such as cookies and authentication tokens. The attacker could potentially gain control of user accounts or compromise the integrity of the application itself. The scope of impact depends on the specific functionality affected by the XSS vulnerability and the privileges of the affected users.

1. Reserved2023-11-01
2. Published2023-11-01
3. Modified2025-02-27
4. EPSS updated2026-04-02

The recommended mitigation for CVE-2023-5904 is to immediately upgrade to version 3.3.0-16 or later. This version contains a fix that addresses the underlying vulnerability. If upgrading is not immediately feasible, consider implementing input validation and output encoding techniques to sanitize user-supplied data and prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS attacks can also provide an additional layer of protection. After upgrading, confirm the fix by attempting to inject a simple XSS payload into a vulnerable input field and verifying that the script is not executed.