cvelistv5 - cve-2022-31192

CVE-2022-31192 (GCVE-0-2022-31192)

Vulnerability from cvelistv5 – Published: 2022-08-01 20:30 – Updated: 2025-04-23 17:55

Title

Cross Site Scripting possible in DSpace JSPUI "Request a Copy" feature

Summary

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity ?

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/DSpace/DSpace/commit/f7758457b…	x_refsource_MISC
	https://github.com/DSpace/DSpace/security/advisor…	x_refsource_CONFIRM
	https://github.com/DSpace/DSpace/commit/28eb81582…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	DSpace	DSpace	Affected: >= 6.0, < 6.4 Affected: >= 4.0, < 5.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:11:39.685Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31192",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:02:35.997411Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T17:55:14.797Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DSpace",
          "vendor": "DSpace",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0, \u003c 6.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0, \u003c 5.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-01T20:30:36.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
        }
      ],
      "source": {
        "advisory": "GHSA-4wm8-c2vv-xrpq",
        "discovery": "UNKNOWN"
      },
      "title": "Cross Site Scripting possible in DSpace JSPUI \"Request a Copy\" feature",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-31192",
          "STATE": "PUBLIC",
          "TITLE": "Cross Site Scripting possible in DSpace JSPUI \"Request a Copy\" feature"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "DSpace",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 6.0, \u003c 6.4"
                          },
                          {
                            "version_value": "\u003e= 4.0, \u003c 5.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "DSpace"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9",
              "refsource": "MISC",
              "url": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9"
            },
            {
              "name": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq",
              "refsource": "CONFIRM",
              "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq"
            },
            {
              "name": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37",
              "refsource": "MISC",
              "url": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-4wm8-c2vv-xrpq",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-31192",
    "datePublished": "2022-08-01T20:30:36.000Z",
    "dateReserved": "2022-05-18T00:00:00.000Z",
    "dateUpdated": "2025-04-23T17:55:14.797Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"4.0\", \"versionEndIncluding\": \"5.10\", \"matchCriteriaId\": \"D0931332-ACDA-450E-BDC7-BE5D44E27F66\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*\", \"versionStartExcluding\": \"6.0\", \"versionEndExcluding\": \"6.4\", \"matchCriteriaId\": \"27C1503E-2C8B-43CD-8937-9ABE6C24C67F\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \\\"Request a Copy\\\" feature does not properly escape values submitted and stored from the \\\"Request a Copy\\\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.\"}, {\"lang\": \"es\", \"value\": \"El software de c\\u00f3digo abierto DSpace es una aplicaci\\u00f3n de repositorio que proporciona acceso duradero a recursos digitales. dspace-jspui es un componente de interfaz de usuario para DSpace. La funci\\u00f3n \\\"Request a Copy\\\" de JSPUI no escapa adecuadamente de los valores enviados y almacenados desde el formulario \\\"Request a Copy\\\". Esto significa que las peticiones de elementos podr\\u00edan ser vulnerables a ataques de tipo XSS. Esta vulnerabilidad s\\u00f3lo afecta a la JSPUI. Es recomendado a usuarios actualizar. No se presentan mitigaciones conocidas para esta vulnerabilidad\"}]",
      "id": "CVE-2022-31192",
      "lastModified": "2024-11-21T07:04:05.603",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}]}",
      "published": "2022-08-01T21:15:13.347",
      "references": "[{\"url\": \"https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-31192\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2022-08-01T21:15:13.347\",\"lastModified\":\"2024-11-21T07:04:05.603\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \\\"Request a Copy\\\" feature does not properly escape values submitted and stored from the \\\"Request a Copy\\\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.\"},{\"lang\":\"es\",\"value\":\"El software de c\u00f3digo abierto DSpace es una aplicaci\u00f3n de repositorio que proporciona acceso duradero a recursos digitales. dspace-jspui es un componente de interfaz de usuario para DSpace. La funci\u00f3n \\\"Request a Copy\\\" de JSPUI no escapa adecuadamente de los valores enviados y almacenados desde el formulario \\\"Request a Copy\\\". Esto significa que las peticiones de elementos podr\u00edan ser vulnerables a ataques de tipo XSS. Esta vulnerabilidad s\u00f3lo afecta a la JSPUI. Es recomendado a usuarios actualizar. No se presentan mitigaciones conocidas para esta vulnerabilidad\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.8,\"impactScore\":3.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0\",\"versionEndIncluding\":\"5.10\",\"matchCriteriaId\":\"D0931332-ACDA-450E-BDC7-BE5D44E27F66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"6.0\",\"versionEndExcluding\":\"6.4\",\"matchCriteriaId\":\"27C1503E-2C8B-43CD-8937-9ABE6C24C67F\"}]}]}],\"references\":[{\"url\":\"https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"product\": \"DSpace\", \"vendor\": \"DSpace\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 6.0, \u003c 6.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.0, \u003c 5.11\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \\\"Request a Copy\\\" feature does not properly escape values submitted and stored from the \\\"Request a Copy\\\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.\"}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"LOW\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\", \"version\": \"3.1\"}}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2022-08-01T20:30:36.000Z\", \"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\"}, \"references\": [{\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9\"}, {\"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq\"}, {\"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\"}], \"source\": {\"advisory\": \"GHSA-4wm8-c2vv-xrpq\", \"discovery\": \"UNKNOWN\"}, \"title\": \"Cross Site Scripting possible in DSpace JSPUI \\\"Request a Copy\\\" feature\", \"x_legacyV4Record\": {\"CVE_data_meta\": {\"ASSIGNER\": \"security-advisories@github.com\", \"ID\": \"CVE-2022-31192\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Cross Site Scripting possible in DSpace JSPUI \\\"Request a Copy\\\" feature\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"product_name\": \"DSpace\", \"version\": {\"version_data\": [{\"version_value\": \"\u003e= 6.0, \u003c 6.4\"}, {\"version_value\": \"\u003e= 4.0, \u003c 5.11\"}]}}]}, \"vendor_name\": \"DSpace\"}]}}, \"data_format\": \"MITRE\", \"data_type\": \"CVE\", \"data_version\": \"4.0\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \\\"Request a Copy\\\" feature does not properly escape values submitted and stored from the \\\"Request a Copy\\\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.\"}]}, \"impact\": {\"cvss\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"LOW\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"scope\": \"CHANGED\", \"userInteraction\": \"REQUIRED\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L\", \"version\": \"3.1\"}}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}]}, \"references\": {\"reference_data\": [{\"name\": \"https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9\", \"refsource\": \"MISC\", \"url\": \"https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9\"}, {\"name\": \"https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq\", \"refsource\": \"CONFIRM\", \"url\": \"https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq\"}, {\"name\": \"https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\", \"refsource\": \"MISC\", \"url\": \"https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\"}]}, \"source\": {\"advisory\": \"GHSA-4wm8-c2vv-xrpq\", \"discovery\": \"UNKNOWN\"}}}, \"adp\": [{\"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T07:11:39.685Z\"}, \"title\": \"CVE Program Container\", \"references\": [{\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9\"}, {\"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"], \"url\": \"https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq\"}, {\"tags\": [\"x_refsource_MISC\", \"x_transferred\"], \"url\": \"https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\"}]}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-31192\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T14:02:35.997411Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T14:02:37.420Z\"}}]}",
      "cveMetadata": "{\"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"assignerShortName\": \"GitHub_M\", \"cveId\": \"CVE-2022-31192\", \"datePublished\": \"2022-08-01T20:30:36.000Z\", \"dateReserved\": \"2022-05-18T00:00:00.000Z\", \"dateUpdated\": \"2025-04-23T17:55:14.797Z\", \"state\": \"PUBLISHED\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2022-31192

Vulnerability from fkie_nvd - Published: 2022-08-01 21:15 - Updated: 2024-11-21 07:04

Severity ?

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9	Patch, Third Party Advisory
security-advisories@github.com	https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9	Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq	Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	duraspace	dspace	*
	duraspace	dspace	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D0931332-ACDA-450E-BDC7-BE5D44E27F66",
              "versionEndIncluding": "5.10",
              "versionStartIncluding": "4.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "27C1503E-2C8B-43CD-8937-9ABE6C24C67F",
              "versionEndExcluding": "6.4",
              "versionStartExcluding": "6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "El software de c\u00f3digo abierto DSpace es una aplicaci\u00f3n de repositorio que proporciona acceso duradero a recursos digitales. dspace-jspui es un componente de interfaz de usuario para DSpace. La funci\u00f3n \"Request a Copy\" de JSPUI no escapa adecuadamente de los valores enviados y almacenados desde el formulario \"Request a Copy\". Esto significa que las peticiones de elementos podr\u00edan ser vulnerables a ataques de tipo XSS. Esta vulnerabilidad s\u00f3lo afecta a la JSPUI. Es recomendado a usuarios actualizar. No se presentan mitigaciones conocidas para esta vulnerabilidad"
    }
  ],
  "id": "CVE-2022-31192",
  "lastModified": "2024-11-21T07:04:05.603",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-08-01T21:15:13.347",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4WM8-C2VV-XRPQ

Vulnerability from github – Published: 2022-08-06 05:46 – Updated: 2022-08-06 05:46

Summary

JSPUI Possible Cross Site Scripting in "Request a Copy" Feature

Details

Impact

The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI.

This vulnerability does NOT impact the XMLUI or 7.x.

Patches

DSpace 6.x: * Fixed in 6.4 via commit: https://github.com/DSpace/DSpace/commit/503a6af57fd720c37b0d86c34de63baa5dd85819 * 6.x patch file: https://github.com/DSpace/DSpace/commit/503a6af57fd720c37b0d86c34de63baa5dd85819.patch (may be applied manually if an immediate upgrade to 6.4 is not possible)

DSpace 5.x: * Fixed in 5.11 via commit: https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37 * 5.x patch file: https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37.patch (may be applied manually if an immediate upgrade to 5.11 or 6.4 is not possible)

Apply the patch to your DSpace

If at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows: 1. Download the appropriate patch file to the machine where DSpace is running 2. From the [dspace-src] folder, apply the patch, e.g. git apply [name-of-file].patch 3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps: 1. Rebuild DSpace, e.g. mvn -U clean package (This will recompile all DSpace code) 2. Redeploy DSpace, e.g. ant update (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder. 3. Restart Tomcat

Workarounds

As a workaround, you can temporarily disable the "Request a Copy" feature by either commenting out the below configuration (or setting its value to empty):

# Comment out this default value
# request.item.type = all

Once your JSPUI site is patched, you can re-enable this setting. See https://wiki.lyrasis.org/display/DSDOC6x/Request+a+Copy for more information on this setting.

References

Discovered & reported by Andrea Bollini of 4Science

For more information

If you have any questions or comments about this advisory: * Email us at security@dspace.org

Severity ?

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.dspace:dspace-jspui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0"
            },
            {
              "fixed": "5.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.dspace:dspace-jspui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0"
            },
            {
              "fixed": "6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-08-06T05:46:27Z",
    "nvd_published_at": "2022-08-01T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form.  This means that item requests could be vulnerable to XSS attacks.  This vulnerability only impacts the JSPUI.\n\n_This vulnerability does NOT impact the XMLUI or 7.x._\n\n### Patches\n\n_DSpace 6.x:_ \n* Fixed in 6.4 via commit: https://github.com/DSpace/DSpace/commit/503a6af57fd720c37b0d86c34de63baa5dd85819\n* 6.x patch file: https://github.com/DSpace/DSpace/commit/503a6af57fd720c37b0d86c34de63baa5dd85819.patch (may be applied manually if an immediate upgrade to 6.4 is not possible)\n\n_DSpace 5.x:_\n* Fixed in 5.11 via commit: https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37\n* 5.x patch file: https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37.patch (may be applied manually if an immediate upgrade to 5.11 or 6.4 is not possible)\n\n#### Apply the patch to your DSpace\nIf at all possible, we recommend upgrading your DSpace site based on the upgrade instructions. However, if you are unable to do so, you can manually apply the above patches as follows:\n1. Download the appropriate patch file to the machine where DSpace is running\n2. From the `[dspace-src]` folder, apply the patch, e.g. `git apply [name-of-file].patch`\n3. Now, update your DSpace site (based loosely on the Upgrade instructions). This generally involves three steps:\n    1. Rebuild DSpace, e.g. `mvn -U clean package`  (This will recompile all DSpace code)\n    2. Redeploy DSpace, e.g. `ant update`  (This will copy all updated WARs / configs to your installation directory). Depending on your setup you also may need to copy the updated WARs over to your Tomcat webapps folder.\n    3. Restart Tomcat\n\n### Workarounds\nAs a workaround, you can temporarily disable the \"Request a Copy\" feature by either commenting out the below configuration (or setting its value to empty):\n```\n# Comment out this default value\n# request.item.type = all\n```\nOnce your JSPUI site is patched, you can re-enable this setting. See https://wiki.lyrasis.org/display/DSDOC6x/Request+a+Copy for more information on this setting.\n\n### References\nDiscovered \u0026 reported by Andrea Bollini of 4Science\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at security@dspace.org\n",
  "id": "GHSA-4wm8-c2vv-xrpq",
  "modified": "2022-08-06T05:46:27Z",
  "published": "2022-08-06T05:46:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31192"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/DSpace/DSpace"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "JSPUI Possible Cross Site Scripting in \"Request a Copy\" Feature"
}

GSD-2022-31192

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2022-31192

Aliases

CVE-2022-31192

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2022-31192",
    "description": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
    "id": "GSD-2022-31192"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2022-31192"
      ],
      "details": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
      "id": "GSD-2022-31192",
      "modified": "2023-12-13T01:19:17.743523Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2022-31192",
        "STATE": "PUBLIC",
        "TITLE": "Cross Site Scripting possible in DSpace JSPUI \"Request a Copy\" feature"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "DSpace",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 6.0, \u003c 6.4"
                        },
                        {
                          "version_value": "\u003e= 4.0, \u003c 5.11"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "DSpace"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9",
            "refsource": "MISC",
            "url": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9"
          },
          {
            "name": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq",
            "refsource": "CONFIRM",
            "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq"
          },
          {
            "name": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37",
            "refsource": "MISC",
            "url": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-4wm8-c2vv-xrpq",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "[5.0,5.11),[6.0,6.4)",
          "affected_versions": "All versions starting from 5.0 before 5.11, all versions starting from 6.0 before 6.4",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2022-08-06",
          "description": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
          "fixed_versions": [
            "5.11",
            "6.4"
          ],
          "identifier": "CVE-2022-31192",
          "identifiers": [
            "GHSA-4wm8-c2vv-xrpq",
            "CVE-2022-31192"
          ],
          "not_impacted": "All versions before 5.0, all versions starting from 5.11 before 6.0, all versions starting from 6.4",
          "package_slug": "maven/org.dspace/dspace-jspui",
          "pubdate": "2022-08-06",
          "solution": "Upgrade to versions 5.11, 6.4 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq",
            "https://nvd.nist.gov/vuln/detail/CVE-2022-31192",
            "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37",
            "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9",
            "https://github.com/advisories/GHSA-4wm8-c2vv-xrpq"
          ],
          "uuid": "8b940f2e-a779-4795-a173-b9804572bee9"
        },
        {
          "affected_range": "[4.0,5.10],[6.0,6.4)",
          "affected_versions": "All versions starting from 4.0 up to 5.10, all versions after 6.0 before 6.4",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-79",
            "CWE-937"
          ],
          "date": "2022-08-08",
          "description": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
          "fixed_versions": [
            "5.11",
            "6.4"
          ],
          "identifier": "CVE-2022-31192",
          "identifiers": [
            "CVE-2022-31192",
            "GHSA-4wm8-c2vv-xrpq"
          ],
          "not_impacted": "All versions before 4.0, all versions after 5.10 up to 6.0, all versions starting from 6.4",
          "package_slug": "maven/org.dspace/dspace-parent",
          "pubdate": "2022-08-01",
          "solution": "Upgrade to versions 5.11, 6.4 or above.",
          "title": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2022-31192",
            "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9",
            "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq",
            "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
          ],
          "uuid": "d2fd4819-bc4a-42c2-8759-4d37d6c2f76d"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.4",
                "versionStartExcluding": "6.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:duraspace:dspace:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "5.10",
                "versionStartIncluding": "4.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-31192"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI \"Request a Copy\" feature does not properly escape values submitted and stored from the \"Request a Copy\" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9"
            },
            {
              "name": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq"
            },
            {
              "name": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2022-08-08T17:12Z",
      "publishedDate": "2022-08-01T21:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2022-31192 (GCVE-0-2022-31192)

FKIE_CVE-2022-31192

GHSA-4WM8-C2VV-XRPQ

Impact

Patches

Apply the patch to your DSpace

Workarounds

References

For more information

GSD-2022-31192

Tags

Sightings

Nomenclature