Análisis comparativo de vulnerabilidades en gestores editoriales de código abierto: OJS y DSpace bajo evaluación adversarial
Year: 2026
Type: article
Abstract: This study evaluates and compares the security posture of Open Journal Systems (OJS) 3.3.0.20 and DSpace 7.6.7 through systematic review of the National Vulnerability Database and ethical penetration testing in isolated laboratory environments. Five CVEs were identified in OJS, most of them involving Cross-Site Scripting or Cross-Site Request Forgery; DSpace showed two registered vulnerabilities, including a Directory Traversal rated CVSS 7.2. Technical evaluation proceeded in four phases: passive reconnaissance, automated scanning with OWASP ZAP, manual verification with Burp Suite, and comparative analysis. The central finding is confirmed, exploitable CSRF vulnerability in OJS specifically, the server accepted authentication requests without checking the synchronization token and issued valid sessions (CVE-2023-6671, CVSS 8.8). In DSpace, what OWASP ZAP classified as a High-level SQL Injection turned out to be improper error handling once tested manually. Neither platform used TLS encryption or Content Security Policy headers. OJS showed a medium-high risk profile. DSpace showed a medium one, complicated by a security gap between its Angular frontend and its REST API backend. The deficiencies found in both platforms say less about the software than about how institutions in Latin America tend to deploy and maintain it. This study derives technical and institutional mitigation guidelines from those findings.
Source: Publicaciones e Investigación
Author: Jorge Eliecer Hernandez Pérez
Institution: Universidad Nacional Abierta y a Distancia
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7215795053