PT-2022-20597 · Dspace · Dspace

Ozkan Erdogan · Published 2022-08-01 · Updated 2022-08-08 · CVE-2022-31189

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 6.4

Description When an "Internal System Error" occurs in the JSPUI, the entire exception, including the stack trace, is available. Information in this stacktrace may be useful to an attacker in launching a more sophisticated attack. This issue only impacts the JSPUI.

Recommendations For DSpace 6.x, upgrade to version 6.4 or apply the patch file manually. For DSpace 5.x, apply the 6.x patch file or disable the display of error messages in the internal.jsp file by setting the returned exception to "null" at all times. As a temporary workaround, consider disabling the display of error messages in the internal.jsp file until a patch is available.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2022-31189

GHSA-C2J7-66M3-R4FF

Affected Products

Dspace

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31189.json · Exploit
• https://github.com/DSpace/DSpace/commit/afcc6c3389729b85d5c7b0230cbf9aaf7452f31a · Patch
• https://github.com/DSpace/DSpace/security/advisories/GHSA-c2j7-66m3-r4ff · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31189 · Security Note
• https://osv.dev/vulnerability/GHSA-c2j7-66m3-r4ff · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31189 · Vendor Advisory
• https://github.com/DSpace/DSpace · Note
• https://t.me/cibsecurity/47386 · Telegram Post