CVE-2018-12588 - Vulnerability Details - OpenCVE

Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field).

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Public Knowledge Project	Open Monograph Press

Configuration 1 [-]

cpe:2.3:a:public_knowledge_project:open_monograph_press:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937
https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938
https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf
https://github.com/pkp/pkp-lib/issues/3805
https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txt

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2018-06-19T21:00:00

Updated: 2024-08-05T08:38:06.408Z

Reserved: 2018-06-19T00:00:00

Link: CVE-2018-12588

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-06-19T21:29:01.130

Modified: 2024-11-21T03:45:29.580

Link: CVE-2018-12588

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2018-06-19T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field)."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-07-03T16:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf"}, {"tags": ["x_refsource_MISC"], "url": "https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txt"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pkp/pkp-lib/issues/3805"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2018-12588", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938", "refsource": "CONFIRM", "url": "https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938"}, {"name": "https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf", "refsource": "CONFIRM", "url": "https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf"}, {"name": "https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txt", "refsource": "MISC", "url": "https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txt"}, {"name": "https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937", "refsource": "CONFIRM", "url": "https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937"}, {"name": "https://github.com/pkp/pkp-lib/issues/3805", "refsource": "CONFIRM", "url": "https://github.com/pkp/pkp-lib/issues/3805"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T08:38:06.408Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txt"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/pkp/pkp-lib/issues/3805"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2018-12588", "datePublished": "2018-06-19T21:00:00", "dateReserved": "2018-06-19T00:00:00", "dateUpdated": "2024-08-05T08:38:06.408Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:public_knowledge_project:open_monograph_press:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AEA7199-8B4C-42CE-8A1A-3675A6F23611", "versionEndExcluding": "3.1.1-3", "versionStartIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in templates/frontend/pages/searchResults.tpl in Public Knowledge Project (PKP) Open Monograph Press (OMP) v1.2.0 through 3.1.1-2 before 3.1.1-3 allows remote attackers to inject arbitrary web script or HTML via the catalog.noTitlesSearch parameter (aka the Search field)."}, {"lang": "es", "value": "Vulnerabilidad de Cross-Site Scripting (XSS) en templates/frontend/pages/searchResults.tpl en Public Knowledge Project (PKP) Open Journal System (OJS) en versiones v1.2.0 hasta la 3.1.1-2 anterior a 3.1.1-3 permite que atacantes remotos inyecten scripts web o HTML arbitrarios mediante el par\u00e1metro catalog.noTitlesSearch (tambi\u00e9n conocido como campo \"Search\")."}], "id": "CVE-2018-12588", "lastModified": "2024-11-21T03:45:29.580", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-06-19T21:29:01.130", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/pkp/pkp-lib/issues/3805"}, {"source": "cve@mitre.org", "tags": ["Technical Description", "Third Party Advisory"], "url": "https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://forum.pkp.sfu.ca/t/ojs-3-1-1-2-and-omp-3-1-1-3-released/45937"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://forum.pkp.sfu.ca/t/xss-vulnerability-alert/45938"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/pkp/omp/commit/bfdcdec64865238163282c5940a6c7896c0977bf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/pkp/pkp-lib/issues/3805"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Technical Description", "Third Party Advisory"], "url": "https://metamorfosec.com/Files/Advisories/METS-2018-002-A_XSS_Vulnerability_in_OMP_1.2.0_to_3.1.1-2.txt"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}