pkp vulnerabilities

Recent CVEs affecting pkp products. 4 tracked.

pkp has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2023-11-01. Highest priority: CVE-2023-4695 (score 52/100).

• CVE-2023-5899 HIGH 8.8 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5898 HIGH 8.8 UPGRADE Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-5889 HIGH 8.2 UPGRADE Insufficient Session Expiration in GitHub repository pkp/pkp-lib prior to 3.3.0-16.
• CVE-2023-4695 HIGH 8.1 UPGRADE Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16.

FAQ

How do I fix pkp vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is pkp being exploited right now?

None of the tracked pkp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which pkp CVE should I patch first?

CVE-2023-4695 currently ranks highest (52/100): Use of Predictable Algorithm in Random Number Generator in GitHub repository pkp/pkp-lib prior to 3.3.0-16..

Products

• pkb-lib
• pkp web application library

RSS feed for pkp · ← Back to latest CVEs