CVE-2024-56525 XML external entity in n/a
A Journal Editor can exploit an XXE vulnerability to escalate privileges to super admin and install backdoor plugins in PKP publishing platforms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-56525?
CVE-2024-56525 is a critical vulnerability in n/a, published on 24 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin, by uploading a crafted XML document as a User XML Plugin.
Weakness: CWE-276
Which versions are affected by CVE-2024-56525?
How do I fix CVE-2024-56525?
No fix has been published for CVE-2024-56525 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-56525 being exploited?
There is no known exploitation of CVE-2024-56525 in the wild and no public exploit code.
Sources
Also known as GHSA-2vfq-pq87-ph87.