PT-2023-18612 · Apache+1 · Apache Jena+1

L3Yx · Publicado 2023-04-25 · Atualizado 2024-01-21 · CVE-2023-22665

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Jena versions 3.7.0 through 4.8.0

Description The issue is related to insufficient checking of user queries and restrictions of called script functions in Apache Jena, allowing a remote user to execute arbitrary javascript via a SPARQL query.

Recommendations For Apache Jena versions 3.7.0 through 4.8.0, consider disabling custom script invocation until a patch is available to prevent the execution of arbitrary javascript. Restrict access to SPARQL query endpoints to minimize the risk of exploitation. Avoid using custom scripts in Apache Jena until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-917

Identificadores relacionados

CVE-2023-22665

GHSA-J927-W6G7-7C7W

GHSA-XGH5-GWQ5-RPX8

Produtos afetados

Apache Jena

Debian

Referências · 17

• https://github.com/apache/jena · Nota
• http://openwall.com/lists/oss-security/2023/07/11/11 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-22665 · Nota de Segurança
• https://t.me/cvenotify/68154 · Publicação no Telegram
• https://ubuntu.com/security/CVE-2023-22665 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j927-w6g7-7c7w · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22665 · Aviso do Fabricante
• https://lists.apache.org/thread/s0dmpsxcwqs57l4qfs415klkgmhdxq7s · Aviso do Fabricante
• https://lists.apache.org/thread/7hg0t2kws3fyr75dl7lll8389xzzc46z · Nota
• https://security-tracker.debian.org/tracker/CVE-2023-22665 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32200 · Nota de Segurança
• https://t.me/cvenotify/49025 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2023-22665 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-xgh5-gwq5-rpx8 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22665 · Aviso do Fabricante