CVE-2022-31193

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-31193
DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This issue has been patched in versions 5.11 and 6.4. Users are advised to upgrade. There are no known workaround for this vulnerability.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de Patch Third Party Advisory
https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9 Patch Third Party Advisory
https://github.com/DSpace/DSpace/security/advisories/GHSA-763j-q7wv-vf3m Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*
cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*
History

08 Aug 2022, 17:13

Type Values Removed Values Added
References (MISC) https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9 - (MISC) https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9 - Patch, Third Party Advisory
References (CONFIRM) https://github.com/DSpace/DSpace/security/advisories/GHSA-763j-q7wv-vf3m - (CONFIRM) https://github.com/DSpace/DSpace/security/advisories/GHSA-763j-q7wv-vf3m - Patch, Third Party Advisory
References (MISC) https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de - (MISC) https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de - Patch, Third Party Advisory
CPE cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

01 Aug 2022, 22:15

Type Values Removed Values Added
Summary DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This issue has been patched in versions 5.11 and 6.4. Users are advised to upgrade. There are no known workaround for this vulnerability. DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This issue has been patched in versions 5.11 and 6.4. Users are advised to upgrade. There are no known workaround for this vulnerability.

01 Aug 2022, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-08-01 21:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-31193

Mitre link : CVE-2022-31193

CVE.ORG link : CVE-2022-31193

JSON object : View

Products Affected

duraspace

  • dspace
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')