CVE-2022-31192

Katalog CVE

CVSS 6.1 · Medium EPSS 0,77%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada duraspace dspace. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI "Request a Copy" feature does not properly escape values submitted and stored from the "Request a Copy" form. This means that item requests could be vulnerable to XSS attacks. This vulnerability only impacts the JSPUI. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

1 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/DSpace/DSpace/commit/28eb8158210d41168a62ed5f9e044f754513bc37 patch · advisory pihak ketiga
• https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9 patch · advisory pihak ketiga
• https://github.com/DSpace/DSpace/security/advisories/GHSA-4wm8-c2vv-xrpq patch · advisory pihak ketiga