CVE-2022-31191

Katalog CVE

CVSS 6.1 · Medium EPSS 0,78%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada duraspace dspace. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocomplete HTML does not properly escape text passed to it. Both are vulnerable to XSS. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD

1 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,78% peluang dieksploitasi; lebih tinggi dari 54,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/DSpace/DSpace/commit/35030a23e48b5946f5853332c797e1c4adea7bb7 patch · advisory pihak ketiga
• https://github.com/DSpace/DSpace/commit/6f75bb084ab1937d094208c55cd84340040bcbb5 patch · advisory pihak ketiga
• https://github.com/DSpace/DSpace/commit/c89e493e517b424dea6175caba54e91d3847fc3a patch · advisory pihak ketiga
• https://github.com/DSpace/DSpace/commit/ebb83a75234d3de9be129464013e998dc929b68d patch · advisory pihak ketiga
• https://github.com/DSpace/DSpace/security/advisories/GHSA-c558-5gfm-p2r8 patch · advisory pihak ketiga