PT-2022-20602 · Dspace · Dspace

Johannes Moritz · Published 2022-08-01 · Updated 2022-08-08 · CVE-2022-31193

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions DSpace versions prior to 5.11 DSpace versions prior to 6.4

Description The JSPUI controlled vocabulary servlet in DSpace is vulnerable to an open redirect attack. An attacker can craft a malicious URL that looks like a legitimate DSpace/repository URL, which redirects the target to a site of the attacker's choice when clicked. This issue does not impact the XMLUI or 7.x versions.

Recommendations For DSpace 5.x versions: Upgrade to version 5.11 or apply the patch file from https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de.patch and follow the instructions to manually apply the patch. For DSpace 6.x versions: Upgrade to version 6.4 or apply the patch file from https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9.patch and follow the instructions to manually apply the patch. In general, if an immediate upgrade is not possible, manually applying the provided patches is recommended.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-31193

GHSA-763J-Q7WV-VF3M

Affected Products

Dspace

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31193.json · Exploit
• https://github.com/DSpace/DSpace/commit/f7758457b7ec3489d525e39aa753cc70809d9ad9 · Patch
• https://github.com/DSpace/DSpace/commit/5f72424a478f59061dcc516b866dcc687bc3f9de · Patch
• https://github.com/DSpace/DSpace/security/advisories/GHSA-763j-q7wv-vf3m · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31193 · Security Note
• https://osv.dev/vulnerability/GHSA-763j-q7wv-vf3m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31193 · Vendor Advisory
• https://github.com/DSpace/DSpace · Note
• https://t.me/cibsecurity/47372 · Telegram Post