CVE-2022-24181

Name of the Vulnerable Software and Affected Versions PKP Open Journals System versions 2.4.8 through 3.3

Description The issue allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header, enabling cross-site scripting (XSS) attacks. This is achieved through Host Header injection.

Recommendations For versions 2.4.8 through 3.3, consider restricting access to the X-Forwarded-Host Header to minimize the risk of exploitation. As a temporary workaround, disabling the use of the X-Forwarded-Host Header until a patch is available can help mitigate the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.