Security Advisory

CVE-2024-56525

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-02-24 00:00:00

Last updated 2025-02-25 14:26:32

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.

← Browse all CVEs View on cve.org ↗