CVE-2022-31193: duraspace dspace

csirt@kutim:~/threat-intel/cve/CVE-2022-31193

CVSS 6.1 · Medium EPSS 0,86%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada duraspace dspace. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

DSpace open source software is a repository application which provides durable access to digital resources. dspace-jspui is a UI component for DSpace. The JSPUI controlled vocabulary servlet is vulnerable to an open redirect attack, where an attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL. When that URL is clicked by the target, it redirects them to a site of the attacker's choice. This issue has been patched in versions 5.11 and 6.4. Users are advised to upgrade. There are no known workaround for this vulnerability.

Rincian

Terbit di NVD: 1 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
EPSS (30 hari): 0,86% peluang dieksploitasi; lebih tinggi dari 57,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
duraspace	dspace	Versi 4.0 hingga 5.10
duraspace	dspace	Versi sesudah 6.0 hingga sebelum 6.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de patch · advisory pihak ketiga
https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9 patch · advisory pihak ketiga
https://github.com/DSpace/DSpace/security/advisories/GHSA-763j-q7wv-vf3m patch · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.