CVE-2023-4157: 
PHP vulnerability analysis and mitigation

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability was discovered in GitHub repository omeka/omeka-s affecting versions prior to 4.0.3. The vulnerability was disclosed on August 4, 2023 (NVD, CVE).

The vulnerability is related to improper neutralization of special elements in output that could be used by a downstream component, classified as CWE-74. It has received a CVSS v3.1 base score of 4.8 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N according to NVD's assessment (NVD).

The vulnerability could potentially lead to injection attacks when special elements are not properly neutralized in output. Based on the CVSS score, it has low confidentiality and integrity impacts, with no availability impact, requiring high privileges and user interaction to exploit (NVD).

The vulnerability requires network access, low attack complexity, high privileges, and user interaction to exploit. A proof of concept has been documented on huntr.dev (Huntr).

The vulnerability has been patched in version 4.0.3 of omeka-s. Users should upgrade to this version or later to mitigate the risk. The fix involves properly escaping installation titles when displaying them (GitHub Patch).