CVE-2024-56525

Critical

Published: 24 February 2025

Published

24 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0010 26.6th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-56525 is a critical-severity Incorrect Default Permissions (CWE-276) vulnerability in Openjournaltheme (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 26.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-56525 is an XML External Entity (XXE) vulnerability in the Public Knowledge Project's (PKP) Open Journal Systems (OJS), Open Monograph Press (OMP), and Open Preprint Server (OPS) platforms, affecting versions before 3.3.0.21 and 3.4.x before 3.4.0.8. The issue resides in the User XML Plugin upload functionality, where insufficient parsing of uploaded XML documents allows external entity expansion. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-276 (Incorrect Default Permissions). The vulnerability was published on 2025-02-24.

A user with Journal Editor role privileges can exploit this XXE flaw by uploading a specially crafted XML document via the User XML Plugin feature. Successful exploitation enables the attacker to create a new super admin role within the journal context and insert a backdoor plugin, potentially granting full administrative control over the affected journal instance.

Mitigation requires upgrading to OJS/OMP/OPS version 3.3.0.21 or later, or 3.4.0.8 or later, as detailed in the vendor advisory at https://openjournaltheme.com/user-xml-fatal-vulnerabilities-for-ojs-omp-ops-3-3-0-21-cve-2024-56525/. No additional workarounds are specified in available information.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-4265

Vulnerability details

In Public Knowledge Project (PKP) OJS, OMP, and OPS before 3.3.0.21 and 3.4.x before 3.4.0.8, an XXE attack by the Journal Editor Role can create a new role as super admin in the journal context, and insert a backdoor plugin,…

by uploading a crafted XML document as a User XML Plugin.

CWE(s): CWE-276

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1098 Account Manipulation Persistence

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

XXE in authenticated upload directly enables privilege escalation to super-admin (T1068), account/role manipulation (T1098), and installation of backdoor plugin as server software component (T1505.003).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1