PT-2022-20599 · Dspace · Dspace

David Cavrenne · Published 2022-08-01 · Updated 2023-07-24 · CVE-2022-31190

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 6.4

Description The issue concerns the exposure of metadata on withdrawn items via the XMLUI "mets.xml" object, as long as the handle/URL of the withdrawn item is known. This affects the XMLUI component of DSpace. The severity of this issue is considered low, as item metadata typically does not contain highly sensitive information.

Recommendations To resolve the issue, users are advised to upgrade to DSpace version 6.4 or newer. For DSpace 6.x, a patch file is available, which can be manually applied if an immediate upgrade to 6.4 or above is not possible. The steps to apply the patch include downloading the patch file, applying it from the DSpace source folder, rebuilding DSpace, redeploying it, and then restarting Tomcat. As a workaround, permanently deleting withdrawn items with highly secure metadata can ensure their secure metadata is inaccessible and removed from the system entirely.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2022-31190

GHSA-7W85-PP86-P4PQ

Affected Products

Dspace

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31190.json · Exploit
• https://github.com/DSpace/DSpace/security/advisories/GHSA-7w85-pp86-p4pq · Patch
• https://github.com/DSpace/DSpace/pull/2451 · Patch
• https://github.com/DSpace/DSpace/commit/574e25496a40173653ae7d0a49a19ed8e3458606.patch · Patch
• https://osv.dev/vulnerability/CVE-2022-31190 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31190 · Security Note
• https://osv.dev/vulnerability/GHSA-7w85-pp86-p4pq · Vendor Advisory
• https://github.com/DSpace/DSpace · Note
• https://t.me/cibsecurity/47371 · Telegram Post
• https://t.me/cvenotify/34395 · Telegram Post
• https://t.me/cvenotify/34114 · Telegram Post