XSS in Public Knowledge Project Open Monograph Press
CVE-2018-12588
Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field).
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.016 (75.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
Weakness classification (CWE)
References
- forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938 (Vendor Advisory)
- github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf (Patch, Third Party Advisory)
- metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2… (Technical Description, Third Party Advisory)
- forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937 (Exploit, Patch, Vendor Advisory)
- github.com/pkp/pkp-lib/issues/3805 (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2018-12588?
- CVE-2018-12588 is a medium-severity vulnerability in Public Knowledge Project Open Monograph Press, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2018-06-19.
- How severe is CVE-2018-12588?
- Medium severity. CVSS v3 base score is 6.1 out of 10.