CyberRota Analysis
AI-GeneratedThe vulnerability affects the pkp-lib library versions up to 3.3.0-22, 3.4.0-10, and 3.5.0-4, specifically in the _transformPHP function of XSLTransformer.php, allowing for XML external entity reference attacks that can be executed remotely. This could lead to unauthorized access to sensitive data or system compromise. Organizations using these versions should prioritize upgrading to at least 3.3.0-23, 3.4.0-11, or 3.5.0-5 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function _transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23, 3.4.0-11 and 3.5.0-5 is sufficient to fix this issue. The patch is identified as 78c699370ea43ae2784e1c4ace7c947d207f2b47. Upgrading the affected component is advised.