Cross-site Scripting (XSS) - Stored in pkp/pkp-lib

The primary impact of CVE-2023-5904 is the potential for Cross-Site Scripting (XSS) attacks. An attacker could inject malicious JavaScript code into the pkp-lib application, which would then be executed in the browsers of unsuspecting users. This could lead to various consequences, including session hijacking, redirection to malicious websites, and the theft of sensitive user data such as cookies and authentication tokens. The attacker could potentially gain control of user accounts or compromise the integrity of the application itself. The scope of impact depends on the specific functionality affected by the XSS vulnerability and the privileges of the affected users.

Organizations and individuals using Open Journal Systems (OJS) or other applications built on pkp-lib versions 3.3.0-16 and earlier are at risk. This includes academic institutions, publishers, and researchers who rely on these platforms for managing and publishing scholarly content. Shared hosting environments using vulnerable versions of pkp-lib are particularly susceptible.

• php / server:

grep -r "<script" /path/to/pkp-lib/code

• generic web:

curl -I <affected_url> | grep -i content-security-policy

1. 2023-11-01Disclosure

   disclosure

1. Gereserveerd2023-11-01
2. Gepubliceerd2023-11-01
3. Gewijzigd2025-02-27
4. EPSS bijgewerkt2026-04-02

The recommended mitigation for CVE-2023-5904 is to immediately upgrade to version 3.3.0-16 or later. This version contains a fix that addresses the underlying vulnerability. If upgrading is not immediately feasible, consider implementing input validation and output encoding techniques to sanitize user-supplied data and prevent the injection of malicious scripts. Web Application Firewalls (WAFs) configured to detect and block XSS attacks can also provide an additional layer of protection. After upgrading, confirm the fix by attempting to inject a simple XSS payload into a vulnerable input field and verifying that the script is not executed.