pkp web application library vulnerabilities and fixes

Recent CVEs affecting pkp web application library, with upgrade or downgrade steps. 15 tracked.

Also searched as: pkpwebapplicationlibrary.

pkp web application library has 15 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 15. Most recent: 2023-11-07. Highest priority: CVE-2023-5889 (score 48/100).

• CVE-2023-5904 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5903 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5902 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5901 LOW 3.5 UPGRADE Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5900 LOW 3.5 UPGRADE Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5899 HIGH 8.8 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5898 HIGH 8.8 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5896 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.4.0-4.
• CVE-2023-5895 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5893 HIGH 8.8 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5892 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5891 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Reflected in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5890 MEDIUM 5.4 UPGRADE Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5889 HIGH 8.2 UPGRADE Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-47271 MEDIUM 5.3 UPGRADE PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) an

FAQ

How do I fix pkp web application library vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is pkp web application library being exploited right now?

None of the tracked pkp web application library CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which pkp web application library CVE should I patch first?

CVE-2023-5889 currently ranks highest (48/100): Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16..

RSS feed for pkp web application library · ← Back to latest CVEs