Copyright (c) 2026 Publicaciones e Investigación
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
When the Publicaciones e Investigaciones Journal receives an original study or article from its author(s), whether by email, postal service, or the platforms available for said purpose, know that it may be published in physical or electronic formats in national or international archives, databases, or SIRES. As such, Publications and Research authorizes the reproduction and citation of said material, provided that the description of information is carried out in conformity with bibliographic norms, and mention the corresponding names, authors, article, issue, and pages. Publications and Research, in advance, expresses that the information, concepts, and methods are the responsibility of the author(s). As such, the UNAD does not have any influence whatsoever over that expressed in the manuscript.
Comparative Vulnerability Analysis of Open-Source Editorial Management Systems: OJS and DSpace Under Adversarial Evaluation
This study evaluates and compares the security posture of Open Journal Systems (OJS) 3.3.0.20 and DSpace 7.6.7 through systematic review of the National Vulnerability Database and ethical penetration testing in isolated laboratory environments. Five CVEs were identified in OJS, most of them involving Cross-Site Scripting or Cross-Site Request Forgery; DSpace showed two registered vulnerabilities, including a Directory Traversal rated CVSS 7.2.
Technical evaluation proceeded in four phases: passive reconnaissance, automated scanning with OWASP ZAP, manual verification with Burp Suite, and comparative analysis. The central finding is confirmed, exploitable CSRF vulnerability in OJS specifically, the server accepted authentication requests without checking the synchronization token and issued valid sessions (CVE-2023-6671, CVSS 8.8). In DSpace, what OWASP ZAP classified as a High-level SQL Injection turned out to be improper error handling once tested manually. Neither platform used TLS encryption or Content Security Policy headers.
OJS showed a medium-high risk profile. DSpace showed a medium one, complicated by a security gap between its Angular frontend and its REST API backend. The deficiencies found in both platforms say less about the software than about how institutions in Latin America tend to deploy and maintain it. This study derives technical and institutional mitigation guidelines from those findings.
How to Cite
