{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-7902","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","state":"PUBLISHED","assignerShortName":"VulDB","dateReserved":"2024-08-16T21:14:31.836Z","datePublished":"2024-08-17T22:00:04.738Z","dateUpdated":"2024-08-19T13:44:20.386Z"},"containers":{"cna":{"providerMetadata":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2024-08-17T22:00:04.738Z"},"title":"pkp ojs signOut redirect","problemTypes":[{"descriptions":[{"type":"CWE","cweId":"CWE-601","lang":"en","description":"CWE-601 Open Redirect"}]}],"affected":[{"vendor":"pkp","product":"ojs","versions":[{"version":"3.4.0-6","status":"affected"}]}],"descriptions":[{"lang":"en","value":"A vulnerability was found in pkp ojs up to 3.4.0-6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login/signOut. The manipulation of the argument source with the input .example.com leads to open redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Eine Schwachstelle wurde in pkp ojs bis 3.4.0-6 gefunden. Sie wurde als problematisch eingestuft. Davon betroffen ist unbekannter Code der Datei /login/signOut. Durch das Beeinflussen des Arguments source mit der Eingabe .example.com mit unbekannten Daten kann eine open redirect-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung."}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N"}}],"timeline":[{"time":"2024-08-16T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2024-08-16T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2024-08-16T23:21:00.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"KaioGomes (VulDB User)","type":"reporter"}],"references":[{"url":"https://vuldb.com/?id.274910","name":"VDB-274910 | pkp ojs signOut redirect","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.274910","name":"VDB-274910 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.388216","name":"Submit #388216 | Open Journal Systems Latest Open Redirect","tags":["third-party-advisory"]}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-19T13:44:12.621757Z","id":"CVE-2024-7902","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-08-19T13:44:20.386Z"}}]}}